--- title: WordPress patches a critical severity security vulnerability description: WordPress released version 7.1.2 patching a critical, CVSS 9.2 severity vulnerability (CVE-2026-87902) that lets an unauthenticated attacker achieve remote... canonical: https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: WordPress patches a critical severity security vulnerability | daily.dev og:description: WordPress released version 7.1.2 patching a critical, CVSS 9.2 severity vulnerability (CVE-2026-87902) that lets an unauthenticated attacker achieve remote... og:url: https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl og:image: https://api.daily.dev/og/posts/OLaEMsinl.png og:image:alt: WordPress patches a critical severity security vulnerability og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WordPress patches a critical severity security vulnerability **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary WordPress released version 7.1.2 patching a critical, CVSS 9.2 severity vulnerability (CVE-2026-87902) that lets an unauthenticated attacker achieve remote code execution by manipulating page template resolution to include arbitrary local PHP files. The fix was backported to version 4.7, since the flaw affects nearly a decade of releases. Security firm Patchstack observed reconnaissance within five hours of the patch and full exploitation within about a day, with attackers abusing the legitimate pearcmd.php tool to write malicious PHP to /tmp before triggering execution via the flaw. Experts warn that patch releases now function as exploit roadmaps, that enterprises with strict change-control processes may be slower to patch than automatically-updated hobbyist sites, and that many organizations are unaware of the full scope of their WordPress footprint, including forgotten marketing microsites, acquired-company properties, and agency-built pages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-87902 in WordPress and how does it lead to remote code execution? CVE-2026-87902 is a critical, unauthenticated RCE vulnerability in WordPress core where page template resolution can be manipulated to include a chosen readable local PHP file outside the active theme directories. Attackers combine it with abuse of pearcmd.php, a legitimate PHP package management tool, to write malicious PHP to /tmp, then trigger execution through the flaw. It carries a 9.2 CVSS score and was fixed in WordPress 7.1.2, released September 22. _Teams tracking WordPress vulnerabilities and patch timelines can follow security fixes like this one on daily.dev._ ### Which WordPress versions are affected by the 7.1.2 security patch and how far back was it backported? The vulnerability affects WordPress versions 4.7.0 through 7.1.1, and WordPress backported the fix for CVE-2026-87902 all the way through version 4.7 because so many older, forgotten installations remain in use. This nearly decade-long affected range means enterprises with unmigrated marketing microsites, acquired-company pages, or agency-built sites are especially at risk. _Auditing a sprawling web estate for outdated WordPress installs gets easier when patch news reaches you fast via daily.dev._ ### How quickly did attackers exploit the WordPress 7.1.2 security patch after release? Attackers began reconnaissance against WordPress sites within about five hours of the 7.1.2 patch shipping on September 22, according to telemetry from security firm Patchstack, and moved to full exploitation using malicious payloads within roughly a day, with traffic volume increasing tenfold. Patchstack blocked the first exploitation attempt at 11:49 UTC the same day the patch was released, using payloads matching the exact encoding the fix addressed. _Staying ahead of exploit timelines this tight means catching critical WordPress security news the moment it breaks, which is where daily.dev helps._ ## Similar posts on daily.dev - [wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins](https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu) · Latest Hacking News · 2 upvotes · 0 comments - [CVE-2026-1357: WordPress Plugin RCE Exposes Sites to Full Takeover](https://daily.dev/posts/cve-2026-1357-wordpress-plugin-rce-exposes-sites-to-full-takeover-fq2jk89o7) · Security Boulevard · 0 upvotes · 0 comments - [CISA flags WordPress RCE flaw as actively exploited in attacks](https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"WordPress patches a critical severity security vulnerability","url":"https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl"},"datePublished":"2026-09-24T20:31:22.589Z","dateModified":"2026-09-28T12:55:50.005Z","description":"WordPress released version 7.1.2 patching a critical, CVSS 9.2 severity vulnerability (CVE-2026-87902) that lets an unauthenticated attacker achieve remote...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6af3ad9175991ddeb8d6cb6d99e59705?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6af3ad9175991ddeb8d6cb6d99e59705?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,wordpress","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"WordPress patches a critical severity security vulnerability"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/wordpress-patches-a-critical-severity-security-vulnerability-olaemsinl#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-87902 in WordPress and how does it lead to remote code execution?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-87902 is a critical, unauthenticated RCE vulnerability in WordPress core where page template resolution can be manipulated to include a chosen readable local PHP file outside the active theme directories. Attackers combine it with abuse of pearcmd.php, a legitimate PHP package management tool, to write malicious PHP to /tmp, then trigger execution through the flaw. It carries a 9.2 CVSS score and was fixed in WordPress 7.1.2, released September 22. Teams tracking WordPress vulnerabilities and patch timelines can follow security fixes like this one on daily.dev."}},{"@type":"Question","name":"Which WordPress versions are affected by the 7.1.2 security patch and how far back was it backported?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability affects WordPress versions 4.7.0 through 7.1.1, and WordPress backported the fix for CVE-2026-87902 all the way through version 4.7 because so many older, forgotten installations remain in use. This nearly decade-long affected range means enterprises with unmigrated marketing microsites, acquired-company pages, or agency-built sites are especially at risk. Auditing a sprawling web estate for outdated WordPress installs gets easier when patch news reaches you fast via daily.dev."}},{"@type":"Question","name":"How quickly did attackers exploit the WordPress 7.1.2 security patch after release?","acceptedAnswer":{"@type":"Answer","text":"Attackers began reconnaissance against WordPress sites within about five hours of the 7.1.2 patch shipping on September 22, according to telemetry from security firm Patchstack, and moved to full exploitation using malicious payloads within roughly a day, with traffic volume increasing tenfold. Patchstack blocked the first exploitation attempt at 11:49 UTC the same day the patch was released, using payloads matching the exact encoding the fix addressed. Staying ahead of exploit timelines this tight means catching critical WordPress security news the moment it breaks, which is where daily.dev helps."}}]} ```