WordPress core CVE-2026-87902 exploited (KEV): update to 7.1.2 now

I noticed a new entry in CISA KEV on 25 Sep. 2026 called "WordPress Core Remote File Inclusion Vulnerability" for CVE-2026-87902, so I went back and read all three original sources: the WordPress 7.1.2 release announcement, the project's GitHub security advisory and the NVD record. The KEV title and the advisory title do not quite match, and this affects core rather than a plugin, so avoiding additional installations will not sidestep it.

What happened

According to the advisory, an unauthenticated attacker can make get_page_template(), the function that selects a page's template file, include a .php file readable by the web server that is outside the active theme directory. The vulnerability is classified as CWE-98, and the advisory calls it "Unauthenticated path traversal in page-template resolution leading to conditional RCE", while CISA calls it Remote File Inclusion. Whatever the name, I think the effect to remember is "including a local file may execute code".

The word conditional matters: not every site running an unpatched version can be taken over immediately. The advisory says both conditions must be met.

1. The active theme (child or parent) has a top-level directory whose name begins with page-. The advisory gives Twenty Twelve, Twenty Fourteen and third-party themes such as Neve, Hestia and Sydney as examples.
2. A .php file exists locally and is readable by the web server account. The advisory gives PEAR's pearcmd.php with register_argc_argv set to On as an example, and states that the official php Docker image and cPanel defaults (PHP before 8.5) meet this condition.

Severity

The figures differ between sources, so I have listed them separately.

The two scores use different systems (v4.0 and v3.1), and both vectors reflect the conditions: v3.1 sets AC:H, while v4.0 sets AT:P (a prerequisite exists). I am not judging which side is right; in practical terms, if the conditions are met, the whole system is at risk without the attacker needing any account at all. If the conditions are not met, that is still no reason to leave it unpatched, because CISA considers it actively exploited.

CISA's KEV requirements (as cited by NVD) are to apply vendor mitigations in accordance with BOD 26-04, perform forensics triage and discontinue use of the product if no mitigations are available, while also assessing whether the system is exposed to the internet. These requirements primarily apply to US government agencies, but there is no harm in using them as your own benchmark.

Affected and fixed versions

In the timeline I put together from the original sources, version 7.1.1 (17 Sep.) is still affected, while 7.1.2 (22 Sep.) specifically fixes this issue, and the project states that the fix was backported to every eligible branch down to 4.7.

How to fix it

1. Check versions on every site and every container running WordPress, including old, unmaintained sites
2. Update to the fixed release for the branch in use, then verify checksums
3. Check the conditions: themes with page-* directories, register_argc_argv and pearcmd.php
4. Look for traces, especially on sites exposed to the internet since 22 Sep. that remain unpatched

The only remedy the advisory gives is to update; it lists no workarounds. I have therefore separated the additional measures and made it clear that they are not a fix.

# เช็กรุ่น แล้วอัปเดตเฉพาะ minor/security ในสายเดิม
wp core version
wp core update --minor
wp core verify-checksums

If you are on the 7.1 branch and want to move straight to the latest version, check wp core check-update first. Hosts using the php Docker image need to rebuild the image and redeploy, rather than edit files inside the running container.

# ธีมที่ใช้อยู่มีโฟลเดอร์ระดับบนชื่อ page-* หรือไม่
find /var/www/example.com/wp-content/themes -maxdepth 2 -type d -name 'page-*'

# มี pearcmd.php ในเครื่องหรือไม่
find / -name pearcmd.php -not -path '*/proc/*' 2>/dev/null

; php.ini ของ FPM/Apache (CLI เปิดค่านี้เสมอ เลยดูจาก CLI ไม่ได้)
register_argc_argv = Off

Check whether you have been compromised

The advisory and the 7.1.2 announcement provide no IOCs, so I will not invent request patterns. What you can actually check for are the usual results of an RCE attack.

• Run wp core verify-checksums and wp plugin verify-checksums --all to find files that differ from the originals.
• Run wp user list --role=administrator to look for administrators you did not create.
• Look for new .php files in wp-content/uploads, where they should not normally exist: find wp-content/uploads -name '*.php' -newermt '2026-09-17'
• Review access logs from 22 Sep. onward for unusual web requests or traffic spikes, then compare them with the times suspicious files appeared on the host.
• If the site has been exposed to the internet and running a version below the fixed release since 22 Sep., treat it as at risk. Check the database password and salts in wp-config.php if you find traces of compromise.

My take

I would not leave this until the monthly update cycle, even though its conditions are narrower than the name "RFI" suggests, because CISA has confirmed exploitation, and the official Docker image and cPanel defaults mentioned in the advisory are widely used. If you have not updated since 22 Sep., treat this as urgent work to finish before anything else, then work through the themes and register_argc_argv afterward as staffing allows.

P.S. Some news reports give different dates for CISA's deadline, but the NVD record I opened myself states that it was added to KEV on 25 Sep., with remediation due on 28 Sep. 2026. Those are the dates I am using.

Sources: GitHub security advisory GHSA-7hp8-65ch-5whp (https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp), WordPress 7.1.2 Release (https://wordpress.org/news/2026/09/wordpress-7-1-2-release/), WordPress 7.1.1 (https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/), NVD CVE-2026-87902 (https://nvd.nist.gov/vuln/detail/CVE-2026-87902), CISA KEV Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Information current as of 5 Nov. 2026. I will come back and update this if more details about the attacks become available.