CVE-2026-87902 is a critical path traversal vulnerability in WordPress' page-template resolution, with a CVSS score of 9.2. Unauthenticated attackers can exploit this vulnerability for remote code execution under certain conditions. The vulnerability can be triggered if the top-level directory of the active child or parent theme starts with 'page-' and if the web server can read a chosen local .php file.
The vulnerability affects WordPress versions from 4.7.0 to 7.1.1 and was addressed in version 7.1.2, released on September 22, 2026. Despite the release of a patch, exploitation attempts began within hours of the public disclosure of the vulnerability. Initial exploitation activity was primarily reconnaissance but escalated to active compromises by September 23, 2026.
Attackers targeting CVE-2026-87902 first verify the vulnerability of the target server, check for the inclusion of PEAR's pearcmd.php, and then exploit pearcmd.php to achieve remote code execution. Themes potentially affected by this vulnerability include Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney.
The initial exploitation traffic was reported to be more than ten times the volume seen on the first evening following the disclosure. Additionally, the vulnerability also affects the ClassicPress fork of WordPress, but no security update has been provided for it.