The WordPress security team released WordPress 7.1.2 on September 22, 2026, patching a critical vulnerability in the core page template loading logic. Under certain server and theme configurations, the flaw allows an unauthenticated attacker to execute arbitrary PHP code on the web server.
Site administrators are strongly advised to update immediately. In addition to prior releases in the WordPress 7.1 branch, the vulnerability impacts multiple legacy versions.
This security patch arrives just five days after the release of WordPress 7.1.1 on September 17, which resolved 11 security flaws alongside dozens of general bug fixes.
Flaw Allowed Including External PHP Files Outside Theme Directories
WordPress 7.1.2 addresses a path traversal flaw tied to the get_page_template() function during page template resolution.
The issue stems from how WordPress handles page template selection. An unauthenticated attacker can manipulate the process to force the system to include a PHP file located outside the active theme’s directory.
If a suitable target PHP file exists on the server and specific server/theme criteria are met, this path traversal can escalate to Remote Code Execution (RCE)—allowing full code execution without requiring a logged-in account.
The vulnerability was responsibly disclosed to WordPress developers by security researcher Robert Ressl.
Multiple Popular Themes Affected
Triggering the issue requires the active theme or child theme to contain a top-level directory starting with the page- prefix—such as page-templates, a common convention used across many popular themes.
Affected themes include older default WordPress themes like Twenty Twelve and Twenty Fourteen, as well as widely used third-party themes such as Neve, Hestia, and Sydney.
However, the presence of a page- directory alone is not enough to grant RCE; additional server-side environmental conditions must be met.
Specific PHP and Server Configurations Increase Risk
To achieve code execution, a target PHP file accessible by the web server user must exist on the system.
The security advisory highlights a scenario involving pearcmd.php (part of the PEAR toolset). When pearcmd.php is present, arbitrary code execution becomes viable if the PHP directive register_argc_argv is set to On.
Configurations matching these criteria include:
- Official PHP Docker image-based environments.
- Default cPanel server setups running PHP versions older than 8.5.
Because these setups are common across standard hosting environments, site owners should not delay updating—even if they are uncertain about their specific server software stack.
Backported Security Fixes Delivered to Legacy Versions
Although WordPress developers actively support only the latest release, security patches have been backported to supported legacy branches dating back to WordPress 4.7.
Sites running legacy versions are strongly urged to update to the latest patched point release, or upgrade to WordPress 7.1.2 altogether.
Immediate Action Required
To update manually, navigate to Dashboard → Updates → Update Now in the WordPress admin area.
For sites with background automatic updates enabled, the patch should apply automatically. However, administrators should manually verify that their installation has updated.
Recommended Steps Before Updating:
- Perform a full backup of your website files and database.
- Apply the update via the WP-Admin dashboard or CLI.
- Verify site functionality, active themes, and plugins post-update.
The vulnerability is tracked as CVE-2026-87902. Technical details and advisory notes can be found in the GitHub Security Advisory GHSA-7hp8-65ch-5whp.
