WordPress.org shipped version 7.1.2 on September 22, a security-only release with a single fix. WordPress.org says the update is critical and recommends updating immediately, and for once that isn’t an exaggeration.

What happened

The bug lives in how WordPress decides which template file to load for a page. WordPress builds part of that template’s filename from a URL parameter you can control, without properly checking it first. By crafting that parameter with the kind of ”../” path tricks normally called path traversal, an attacker who isn’t even logged in can get WordPress to pull in a different, unintended PHP file from elsewhere on the server. If that file can be made to contain attacker-controlled code, the result is remote code execution: the attacker runs their own commands on your server.

Two conditions have to line up for the worst-case outcome. Your active theme needs a top-level folder along the lines of “page-templates”, and your server needs a PHP setting called register_argc_argv turned on. That setting ships on by default in the official PHP Docker images and in cPanel hosting environments running PHP versions before 8.5. Without both pieces in place, the bug can still expose file contents but is far less likely to let an attacker run code.

WordPress.org credits security researcher Robert Ressl with reporting the flaw responsibly. It’s tracked as CVE-2026-87902, and security firm Patchstack rated it a 9.2 out of 10 on the CVSS severity scale, calling it the most serious thing WordPress has patched in a while. The flaw affects every WordPress release from 4.7.0 through 7.1.1, close to a decade of versions.

This is the second security release in less than a week. WordPress.org shipped 7.1.1 just four days earlier with 11 unrelated security fixes.

What to do

  1. Update to WordPress 7.1.2 now. Go to your WordPress Dashboard, click Updates, then click Update Now.
  2. If your site supports automatic background updates, it should already be applying the fix without action from you.
  3. WordPress.org is backporting the fix to every branch back to 4.7, so sites on older major versions will also get a patch as those backports become ready.
  4. If you can’t update right away, ask your host whether register_argc_argv is enabled and check whether your active theme has a “page-” prefixed directory. Both need to be true for the worst-case outcome, so turning either off reduces your exposure while you wait to update.

End of article