WordPress CVE-2026-87902 is a critical unauthenticated core vulnerability that WordPress fixed on September 22, 2026. WordPress 7.1.1 is affected despite being a recent security release. WordPress shipped 7.1.2 for the current branch and security backports for maintained older branches. Patchstack says malicious probing began within hours of the patch, while later September 23 reporting says attackers progressed to attempts to write executable files.
What should WordPress site owners know about CVE-2026-87902?
CVE-2026-87902 is an unauthenticated page-template path traversal and local PHP inclusion vulnerability in WordPress core. It can cause WordPress to include a readable local PHP file outside the active theme directories and can reach remote code execution when additional theme and server conditions are present.
The immediate action is to update to WordPress 7.1.2 or the fixed release for the site’s maintained branch. Sites that remained vulnerable while active attack traffic was occurring may also warrant compromise review after patching.
Is WordPress 7.1.1 vulnerable to CVE-2026-87902?
Yes. WordPress’s security advisory lists versions 7.1.0 through 7.1.1 as affected. Version 7.1.2 fixes the flaw for the 7.1 branch.
This matters because WordPress 7.1.1 was itself a recent security release. A site updated for the earlier Click2Shell issue should not assume that 7.1.1 also covers CVE-2026-87902.
TPS has a separate article for that earlier flaw: Click2Shell WordPress Flaw: What 7.1.1 Fixes and When It Reaches RCE. CVE-2026-87902 is a different vulnerability and requires the newer patch generation.
Which WordPress versions fix CVE-2026-87902?
| Affected branch | First fixed release |
|---|---|
| 7.1.0–7.1.1 | 7.1.2 |
| 7.0.0–7.0.5 | 7.0.6 |
| 6.9.0–6.9.8 | 6.9.9 |
| 6.8.0–6.8.9 | 6.8.10 |
| 6.7.0–6.7.8 | 6.7.9 |
| 6.6.0–6.6.8 | 6.6.9 |
| 6.5.0–6.5.11 | 6.5.12 |
| 6.4.0–6.4.11 | 6.4.12 |
| 6.3.0–6.3.11 | 6.3.12 |
| 6.2.0–6.2.12 | 6.2.13 |
| 6.1.0–6.1.13 | 6.1.14 |
| 6.0.0–6.0.15 | 6.0.16 |
| 5.9.0–5.9.17 | 5.9.18 |
| 5.8.0–5.8.16 | 5.8.17 |
| 5.7.0–5.7.18 | 5.7.19 |
| 5.6.0–5.6.20 | 5.6.21 |
| 5.5.0–5.5.21 | 5.5.22 |
| 5.4.0–5.4.22 | 5.4.23 |
| 5.3.0–5.3.24 | 5.3.25 |
| 5.2.0–5.2.27 | 5.2.28 |
| 5.1.0–5.1.25 | 5.1.26 |
| 5.0.0–5.0.28 | 5.0.29 |
| 4.9.0–4.9.32 | 4.9.33 |
| 4.8.0–4.8.31 | 4.8.32 |
| 4.7.0–4.7.36 | 4.7.37 |
WordPress says versions earlier than 4.7 no longer receive security updates. Sites on those releases should not assume a CVE-2026-87902 backport exists.
Does CVE-2026-87902 require authentication?
No. The vulnerable page-template resolution path can be reached without an authenticated WordPress account.
That makes patching especially important because an attacker does not first need a normal WordPress login to reach the vulnerable behavior.
Does every vulnerable WordPress site allow remote code execution?
No. The WordPress advisory distinguishes the vulnerable inclusion primitive from full remote code execution. RCE requires additional theme and server-environment conditions.
On the theme side, the advisory describes a top-level active-theme directory beginning with page- as one relevant condition. It names legacy Twenty Twelve and Twenty Fourteen, plus third-party themes including Neve, Hestia and Sydney, as examples that can satisfy that directory condition.
Being named in the advisory does not mean a site using one of those themes has been compromised. It means that environment may satisfy one prerequisite in the RCE chain.
What server condition can turn local file inclusion into RCE?
The attacker also needs a suitable readable local PHP file that can convert inclusion into code execution under the server’s configuration. WordPress’s advisory identifies some PHP Docker and cPanel-based environments as examples where such a route may exist.
This does not mean PHP, Docker or cPanel has CVE-2026-87902. They are environmental factors that can affect whether the WordPress flaw progresses from local file inclusion to code execution.
Is CVE-2026-87902 being exploited?
Active malicious targeting is confirmed. Patchstack says it observed probing beginning at 17:44 UTC on September 22, less than five hours after WordPress released the patch.
Patchstack’s original disclosure made an important distinction: those initial requests were probes rather than confirmed payload delivery.
Later September 23 reporting says activity then progressed to attempts to write executable files to disk and use them for command execution. TPS treats that progression as reported because the reviewed WordPress and CERT-In advisories do not independently confirm successful in-the-wild code execution or a victim count.
Did CERT-In confirm active exploitation?
No. CERT-In issued a CRITICAL vulnerability note on September 23 and warned that successful exploitation can cause local file inclusion, information disclosure, arbitrary code execution and possible full-system compromise.
That confirms the severity and technical impact. The reviewed CERT-In note does not itself establish the attack-telemetry claims about probing or later file-write attempts.
Has widespread successful compromise been confirmed?
No reliable count of successfully compromised WordPress sites was established in the reviewed evidence. TPS also did not verify named victims, a confirmed attacker group or a geographic campaign concentration.
The correct current state is narrower: vulnerable sites are being actively targeted, later file-write attempts are reported, and successful compromise at broad scale remains unquantified.
What should WordPress administrators do now?
Check the exact core version
Confirm the installed WordPress version rather than assuming a recent security update is sufficient. WordPress 7.1.1 is affected by this CVE.
Install the fixed branch release
Move to WordPress 7.1.2 or the patched release corresponding to the site’s maintained branch. The upstream core patch is the primary remediation.
Review the exposure window
If the site remained vulnerable after malicious probing began on September 22, preserve the timeline and determine whether further compromise review is warranted.
Check for unexpected changes
Use normal incident-response procedures to review unexpected PHP or file changes, unusual web-server activity, unfamiliar administrative changes and relevant host or security telemetry.
Do not rely only on IP blocking
Scanner addresses can change. Blocking individual observed sources is not a substitute for installing the fixed WordPress core release.
Treat WAF rules as supplemental
Hosting-provider or WAF mitigations can reduce exposure, but they should not be described as equivalent to the upstream fix unless the provider explicitly guarantees that coverage.
Is patching enough if the site was exposed before the update?
The update closes the vulnerable WordPress code path, but installing a patch does not automatically reverse a compromise that may have occurred beforehand.
A site that remained vulnerable during active attack traffic may warrant additional review using its normal security and incident-response procedures. That does not mean every exposed site was compromised; patch status and compromise status are different questions.
Is CVE-2026-87902 the same as Click2Shell?
No. Click2Shell was a separate WordPress flaw addressed by WordPress 7.1.1. CVE-2026-87902 affects 7.1.1 itself and was fixed one release later in 7.1.2 and corresponding maintained-branch backports.
Site owners who patched Click2Shell should therefore verify that they also installed the newer CVE-2026-87902 fix.
WordPress CVE-2026-87902: confirmed versus developing
| Question | Current evidence state |
|---|---|
| Is CVE-2026-87902 a critical WordPress core flaw? | Confirmed |
| Does exploitation require authentication? | No |
| Is WordPress 7.1.1 affected? | Yes |
| Is WordPress 7.1.2 fixed? | Yes |
| Do maintained older branches have backports? | Yes |
| Can the flaw reach RCE? | Yes, under additional conditions |
| Has active internet probing been observed? | Yes, confirmed by Patchstack telemetry |
| Have later file-write attempts been reported? | Yes, reported by current security coverage |
| Has mass successful compromise been confirmed? | Not established |
| Is CISA KEV status confirmed in the reviewed evidence? | Not established |
WordPress CVE-2026-87902: direct answers
What version should WordPress 7.1 users install?
WordPress 7.1 users should install 7.1.2 or a later version containing the fix.
Is WordPress 7.1.1 safe from this vulnerability?
No. Version 7.1.1 is affected by CVE-2026-87902.
Are all vulnerable sites automatically vulnerable to RCE?
No. Full RCE depends on additional theme and server conditions described in the WordPress advisory.
Are attackers targeting the flaw?
Yes. Patchstack confirmed malicious probing within hours of patch release. Later file-write attempts are reported, while broad successful-compromise counts remain unknown.
Does updating remove an earlier compromise?
No patch can be assumed to reverse prior unauthorized changes. Sites exposed during active targeting may require compromise review in addition to updating.
What could materially change this article next?
Confirmed successful compromises, CISA KEV addition, new direct exploitation telemetry, malware or persistence findings, hosting-provider mitigations, forced-update activity or a revised WordPress advisory would materially change the current state.
Verification method
ThePulseSignal reviewed the WordPress security advisory and 7.1.2 release, CERT-In’s critical vulnerability note, Patchstack’s original attack telemetry and current security reporting on the later file-write escalation. TPS reconciled the full maintained-branch patch matrix and separated confirmed probing from reported later exploitation activity.
Limitations
The reviewed evidence does not establish the total number of successfully compromised sites, confirmed victims, attacker attribution, current CISA KEV status, campaign geography, definitive compromise IOCs, malware persistence or the prevalence of WordPress environments satisfying all RCE prerequisites.