WordPress published security advisory GHSA-7hp8-65ch-5whp on September 22, 2026, describing CVE-2026-87902, a path-traversal flaw in page-template resolution. The advisory assigns the vulnerability a critical CVSS v4 score of 9.2. Its most important qualification is conditional: an unauthenticated network attacker may be able to make get_page_template() include a selected readable local PHP file outside the active theme directories, but remote code execution requires additional deployment and theme conditions. The mechanics and version lists below are WordPress’s own findings; the supplied material contains no independent reproduction or separate security report.
The opening paragraph introduces the WordPress advisory and its critical but conditional path-traversal vulnerability.
Exploitation begins with control over template resolution rather than an administrator account. According to the advisory, the active child or parent theme must contain a top-level directory whose name begins with page-, such as page-templates. WordPress identifies its legacy Twenty Twelve and Twenty Fourteen themes as examples and also names Neve, Hestia, and Sydney among affected third-party themes. Those names illustrate the condition; the advisory does not say they are the only themes capable of satisfying it. Site owners should therefore inspect the active theme hierarchy rather than relying solely on a theme-name checklist.
A matching directory is not enough by itself. A selected local PHP file must also exist and be readable by the account under which PHP executes. The advisory identifies pearcmd.php as one possible target and describes the established PEAR-command execution transition when register_argc_argv is enabled. It specifically identifies the official PHP Docker image as affected in this respect and says the default cPanel configuration is affected when it uses PHP earlier than 8.5. These examples explain why the flaw can be critical in some hosting environments without implying that every WordPress installation exposes the necessary target file or PHP setting.
The distinction matters operationally. An unauthenticated request, no privileges, and no victim interaction make the potential attack network reachable and comparatively simple once its prerequisites are present. However, the advisory’s attack-requirements metric records that prerequisite deployment conditions are necessary. The evidence therefore supports a conditional risk model: exposure depends on the interaction of vulnerable WordPress code, an eligible theme layout, a readable PHP target, and the relevant PHP configuration. It does not establish that all installations using a named theme are remotely executable, nor does the supplied advisory demonstrate active exploitation in the wild.
WordPress says version 7.1.2 contains the fix and that the correction was backported across supported older branches to WordPress 4.7. The listed patched releases are 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, and 4.7.37. Each immediately preceding release range shown in the advisory is marked affected, extending back to 4.7.0.
For administrators, the first practical step is to compare the installed WordPress version with the branch-specific patched release rather than checking only whether the installation is on a recent major version. An older but fully patched branch can appear out of date while still containing this correction; conversely, a current major release below its branch’s fixed point remains vulnerable. After upgrading, operators managing high-value or internet-facing systems should separately assess whether their active themes contain a qualifying page-* directory and whether the PHP runtime exposes a readable file usable in the described inclusion chain.
The advisory credits Robert Ressl with the responsible disclosure and classifies the weakness under CWE-98, which covers improper control of a filename used in a PHP include or require operation. That classification is consistent with the reported failure occurring during template-file selection. Still, the classification does not mean an attacker can include an arbitrary remote URL or bypass operating-system read permissions. The documented path requires a local PHP target that the web-server account can read, followed by the additional conditions needed to turn inclusion into code execution.
The central reader takeaway is therefore narrower than the headline severity alone suggests. CVE-2026-87902 deserves prompt remediation because authentication, user interaction, and complex attack steps are not required once the environment is suitable. At the same time, the available disclosure does not support treating every WordPress site as equally exposed. Updating to the correct fixed release removes the vulnerable code path; evaluating theme structure and PHP deployment conditions helps operators understand residual risk and prioritize systems where the full exploitation chain could have existed.