CVE-2026-87902 is a path traversal vulnerability in the way WordPress core resolves page templates. A specially crafted request can make WordPress include an arbitrary PHP file already present on the server, without any authentication.

Remote code execution depends on server conditions: the active theme's top-level directory name must start with "page-", the web server account must be able to read the target PHP file, and the PHP setting register_argc_argv must be enabled, which allows the known pearcmd.php technique to turn file inclusion into command execution.

The following WordPress versions are affected:

WordPress 4.7.0 through 7.1.1, on sites where the conditions described above are met – (Affected)

Not affected / patched versions:

WordPress 7.1.2 or later (released 22 September 2026) – (Not affected)
Patched point releases for older branches (back to 4.7.x) published by the WordPress security team – (Not affected)

Successful exploitation may allow attackers to:

• Include and run an arbitrary PHP file on the web server without logging in
• Execute commands on the server, install web shells, and deface or take over the website
• Access the site database and credentials, and use the server to attack other systems

CERTVU recommends the following:

1. Update WordPress Immediately

   Update to WordPress 7.1.2 or later, or to the patched release for your branch. Confirm that automatic background updates actually applied.

2. Reduce Exposure While Updating

3. Remove What You Do Not Need

4. Hunt for Compromise

5. Restore and Rotate if Compromised

   If compromise is suspected, restore from a clean backup, rotate administrator, database, and API credentials, and report the incident to CERTVU.