WordPress 7.1.2 is out with a fix for an unauthenticated path traversal that can end in remote code execution. The advisory went up today: GHSA-7hp8-65ch-5whp, CVE-2026-87902, CVSS 9.2. The fix is backported to every branch back to 4.7, one release per branch.
What the bug does
An unauthenticated attacker can make get_page_template() include a .php file of their choosing, provided it is readable on the server. The file is then executed with the web server’s privileges, which is what turns a traversal into code execution.
Two preconditions, and both have to hold:
- The active theme, child or parent, has a top-level directory whose name starts with
page-. That covers Twenty Twelve and Twenty Fourteen, and some third-party themes in wide use: Neve, Hestia, Sydney. - A local
.phpfile exists and is readable by the web server account. The advisory namespearcmd.phpas the well-known way from there, which needsregister_argc_argvset toOn. The officialphpimage for Docker is affected. So is the default cPanel configuration, as long as PHP is older than 8.5.
Patched versions run from 7.1.2 back to 4.7.37. Robert Ressl reported it.
My read
The theme half of that list is the part people will skim: a top-level directory named page- something is an ordinary thing for a theme to ship, and the advisory puts Neve, Hestia and Sydney alongside the two legacy Twenty themes. The other half is a container problem. A WordPress stack built on the official php image carries pearcmd.php and the ini setting that makes it useful, because that is what the image is. Neither precondition is exotic on its own. Together they are a way in, and the upgrade is a point release.