Critical WordPress core vulnerability patched, update to 7.1.2 now
23 Sep 2026WordPress released version 7.1.2 yesterday, an emergency security update that fixes a critical flaw in core. Every WordPress version from 4.7 through 7.1.1 is affected, which covers the vast majority of sites on the internet.
The vulnerability, tracked as CVE-2026-87902 and scored 9.2 out of 10 on the CVSS scale, is in the way WordPress resolves page templates. By combining double-encoded path traversal sequences with valid page_id and pagename parameters, an attacker with no account on the site can make WordPress include a PHP file of their choosing from elsewhere on the server. If they can plant PHP code in any file the web server can read, such as a log file or an uploaded image, that becomes remote code execution. The flaw was reported responsibly by security researcher Robert Ressl.
Attackers moved quickly. Patchstack recorded the first probing attempts less than five hours after the patch was published, most likely worked out from the patch itself rather than discovered independently. For now the activity is reconnaissance rather than exploitation, but that window will be short. Fixes have been backported as far as WordPress 4.7.37, so there is a patched release available whichever branch you are on. Update now. If you genuinely cannot, block traversal sequences in the pagename parameter at your firewall and keep a close eye on your access logs.
Contact BrightStrike if you would like help assessing whether your WordPress estate is exposed.