WordPress released version 7.1.2 on September 22, fixing a single critical vulnerability: an unauthenticated path traversal issue, tracked as CVE-2026-87902, in the function that resolves which template file renders a page. Researcher Robert Ressl reported the flaw through WordPress’s HackerOne bug bounty program, and the WordPress security team credits him with responsible disclosure in the release notes.
The bug lets an attacker steer that template lookup outside the directory it is meant to stay in, pointing it at a readable PHP file elsewhere on the server. WordPress then includes that file and PHP executes whatever code sits inside it, no account and no action from a logged-in user required. The security team rates the flaw critical, and every WordPress release back to 4.7.0 is affected, which pushed the project to backport the fix across 22 separate release branches in a single day, unusually broad even for a core security release, reaching all the way down to version 4.7.37.
The scale of that backport is the story worth sitting with: a vulnerable code path in WordPress’s own template resolution, not a plugin, has apparently gone unexamined since at least 2016. CyberTech has previously covered how attackers exploited a separate pre-authentication RCE in WordPress core months after a patch shipped, and how one actor used a WordPress exploitation chain to steal government records. Security teams that treat WordPress core as inherently hardened, reserving their scrutiny for the plugin ecosystem, are extending trust to code that clearly still needs auditing, and site operators running any branch back to 4.7 should confirm the backported patch actually applied rather than assuming an old, otherwise-stable install is out of scope.
Source: WordPress.org
