CVE-2026-87902

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7.0 through 7.1.1

Description An unauthenticated attacker can manipulate the get page template() function to include a readable local .php file located outside the active theme directories. This path traversal issue can lead to Remote Code Execution (RCE) if specific pre-conditions are met: the active theme must have a top-level folder starting with page- (e.g., page-templates) and the server must have a readable target PHP file (such as pearcmd.php when register argc argv is enabled). There are reports of attackers exploiting this flaw to achieve RCE and subsequently performing lateral movement across cloud infrastructure.

Recommendations Update WordPress versions 4.7.0 through 7.1.1 to version 7.1.2 or the corresponding backported fix (down to version 4.7.37). As a temporary mitigation, verify if the active theme contains a top-level directory starting with page- and check if the PHP configuration has register argc argv enabled.