Unauthenticated path traversal in page-template resolution leads to code execution in WordPress core (CVE-2026-87902)
Exploitation began within hours of the 2026-09-22 disclosure and has progressed from probing to writing web shells, so any unpatched site left through the normal patch cycle should be assumed reachable by automated attacks now.
An unauthenticated request can make WordPress's get_page_template() resolution include an attacker-chosen readable .php file outside the active theme directories. Depending on server and theme preconditions this becomes local file inclusion and remote code execution; attackers are already writing files to disk that run shell commands when accessed.
Affected: WordPress < 7.1.2 (all branches back to 4.7 have security backports)
How to Test
Confirm the running core version in the WordPress dashboard (Updates screen) — anything below 7.1.2 (or lacking the equivalent security backport for your branch) is vulnerable. Review web server access logs for requests carrying path traversal sequences against page/template resolution, and inspect the filesystem for recently created or modified .php files outside the theme and plugin directories that were not part of a deployment; reports describe attackers dropping files that execute shell commands when accessed.
How to Patch
Update to WordPress 7.1.2, or apply the security backport released for your branch (backports exist for every branch back to 4.7). If an update must wait, put a web application firewall with a rule for this path traversal in front of the site (Patchstack and Wordfence have published coverage).