WordPress 7.1.2 fixes critical template file flaw
WordPress 7.1.2 was released on 22 September 2026 as a security-only update for a single Core vulnerability, but the issue is serious: an unauthenticated local file inclusion in page template resolution that can, in some hosting setups, reach remote code execution. Unauthenticated means an attacker does not need a WordPress account. Local file inclusion means forcing the site to load a file already on the server. Remote code execution means getting the server to run commands or code chosen by the attacker.
According to Patchstack, the flaw affects WordPress Core from 4.7.0 up to and including 7.1.1. It has a CVSS 4.0 score of 9.2, with the vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CVSS, the Common Vulnerability Scoring System, is a standard way to rate the severity of security bugs. The vulnerability is classified as CWE-98, improper control of a filename for an include statement, and has been assigned CVE-2026-87902.
The risk is broader than a normal single-version bug because every branch back to WordPress 4.7 is affected, which Patchstack describes as close to a decade of releases. No login is required to attempt exploitation. That combination matters for website owners because public-facing WordPress sites are reachable by anyone on the internet, and vulnerabilities that need no account are easier to probe at scale.
The vulnerable path sits in the way WordPress chooses page templates. When WordPress renders a page, get_page_template() in wp-includes/template.php builds possible template filenames and passes them to the template loader. One candidate came from the pagename query variable, a value taken from the request. In the vulnerable versions, a nearby page template slug was checked with validate_file(), WordPress’s own check for unsafe file traversal, but the filename built from pagename was not.
That missing check did not make every file on a server reachable. The filename was assembled in the form page-{pagename}.php, so the path had to continue through a directory that genuinely starts with page-, and the included target still had to end in .php because WordPress appended that extension. Patchstack says the practical precondition is an active theme with a top-level directory such as page-templates, a pattern present in legacy default themes and a number of popular third-party themes. An extra urldecode() call, which converts URL-encoded characters back into their normal form, is what could turn a traversal-shaped slug into a real path. Patchstack says it is not publishing a working request.
The step from file inclusion to remote code execution is conditional. Including a local PHP file, where PHP is the programming language WordPress runs on, executes whatever that file normally does. To get arbitrary code execution, an attacker needs a readable .php file on the server that behaves usefully when included. Patchstack identifies PEAR’s pearcmd.php as the well-known candidate, but says it only becomes useful when PHP is running with register_argc_argv enabled. register_argc_argv is a PHP setting that makes command-line style arguments available to scripts.
That setting is not rare in the environments Patchstack names. It is enabled by default in the official PHP Docker images and in cPanel environments on PHP below 8.5. For site owners, the practical reading is therefore not “only unusual servers are at risk.” Patchstack frames the issue as unauthenticated file inclusion always, and code execution when the hosting stack lines up. Its advice is to treat the flaw as critical unless the site’s own stack has been checked and confirmed not to meet those conditions.
WordPress 7.1.2 shipped two relevant changes. The first applies the same validate_file() check to the decoded pagename path that the neighboring branch already had. The second adds a broader containment check, _wp_is_template_path_allowed(), for every resolved template path regardless of which code path produced it. If a file path exists and does not contain a parent-directory traversal marker, it is allowed. Otherwise, WordPress resolves the real path and requires it to sit inside an allowed theme location: the stylesheet directory, the template directory, or theme-compat.
That second change is important because it treats template resolution as a wider class of risk, not just a single missing validation call. A one-line validation change would have addressed the reported path. Requiring every resolved template path to stay inside allowed theme directories adds a safety boundary around the template-loading process itself.
The timeline is compact. On 22 September 2026, WordPress 7.1.2 was released with backported fixes for every supported branch down to 4.7. On the same date, advisory GHSA-7hp8-65ch-5whp was published and CVE-2026-87902 was assigned. Patchstack also added the issue to its vulnerability database and says it deployed a RapidMitigate rule to protected sites, while still recommending an update to the most recent WordPress version available.
Website owners can update through the WordPress Dashboard under Updates or download the release directly from WordPress.org. Sites with automatic background updates enabled should already have received the fix. Because the issue reaches back to WordPress 4.7, fixed releases were published for every branch WordPress still backports to, allowing older sites to take the security fix without a major version jump. Patchstack also notes that only the most recent WordPress version is actively supported, and that remains the version sites should aim to run.
If an immediate update is not possible, the two checks Patchstack recommends are practical risk indicators, not fixes. First, check whether the active theme has a top-level directory beginning with page-. Second, check whether PHP has register_argc_argv enabled. Those answers tell a site owner how close the server is to the worst-case code execution chain, but they do not replace installing the fixed WordPress release. For site owners who prefer not to manage this alone, AEU Hosting is managed WordPress hosting, secured end to end.