Executive Summary

    On September 22nd, WordPress published an advisory regarding a critical vulnerability reported in their flagship CMS software. Tracked as CVE-2026-87902, the flaw lets an unauthenticated, remote attacker manipulate page template resolution to include arbitrary PHP files from outside the active theme directory. Under specific server and theme conditions, the vulnerability can lead to remote code execution and full site compromise.

    WordPress Core powers a large share of the public web, and this flaw sits in the core software rather than an optional plugin or theme. For exploitation, the active parent or child theme must carry a top-level directory whose name begins with “page-”, and the server must hold a readable PHP file that does something useful when included.

    Active probing of internet-facing WordPress sites was observed within hours of the patch, using payloads built from the published fix. Given the size of the exposed population, ease of exploitation on affected configurations, and the absence of a vendor workaround, Beazley Security recommends affected organizations apply available fixes as soon as possible.

    Affected Systems or Products

    Product

    Affected versions

    Patched versions

    7.1

    7.1.0 - 7.1.1

    7.1.2

    7.0

    7.0.0 - 7.0.5

    7.0.6

    6.9

    6.9.0 - 6.9.8

    6.9.9

    6.8

    6.8.0 - 6.8.9

    6.8.10

    6.7

    6.7.0 - 6.7.8

    6.7.9

    6.6

    6.6.0 - 6.6.8

    6.6.9

    6.5

    6.5.0 - 6.5.11

    6.5.12

    6.4

    6.4.0 - 6.4.11

    6.4.12

    6.3

    6.3.0 - 6.3.11

    6.3.12

    6.2

    6.2.0 - 6.2.12

    6.2.13

    6.1

    6.1.0 - 6.1.13

    6.1.14

    6.0

    6.0.0 - 6.0.15

    6.0.16

    5.9

    5.9.0 - 5.9.17

    5.9.18

    5.8

    5.8.0 - 5.8.16

    5.8.17

    5.7

    5.7.0 - 5.7.18

    5.7.19

    5.6

    5.6.0 - 5.6.20

    5.6.21

    5.5

    5.5.0 - 5.5.21

    5.5.22

    5.4

    5.4.0 - 5.4.22

    5.4.23

    5.3

    5.3.0 - 5.3.24

    5.3.25

    5.2

    5.2.0 - 5.2.27

    5.2.28

    5.1

    5.1.0 - 5.1.25

    5.1.26

    5.0

    5.0.0 - 5.0.28

    5.0.29

    4.9

    4.9.0 - 4.9.32

    4.9.33

    4.8

    4.8.0 - 4.8.31

    4.8.32

    4.7

    4.7.0 - 4.7.36

    4.7.37

    CVE-2026-87902 was found in a core component and affects all versions of WordPress. While many affected versions are no longer officially supported, the WordPress Foundation released patches for all versions of the CMS software back to 4.7, as a courtesy to users.

    Mitigations / Workarounds

    WordPress has not published a workaround and affected site owners should update to the fixed release for their branch as soon as possible. If security updates cannot be immediately applied, the following may help to temporarily reduce risk:

    • The path traversal string is delivered through the “pagename” query variable in an incoming HTTP request. Monitoring and blocking traditional directory traversal sequences in that variable via web application firewall or reverse proxy (if available) would provide some measure of protection.

    • A CVE-2026-87902 attack chain will rely on a theme package containing a top-level directory whose name begins with “page-“. Removing any installed themes that match that precondition may also help to reduce risk.

    Patches

    Official fixes are available from WordPress. Sites with automatic background updates enabled receive the update without administrator action, otherwise users can update from the Updates screen in the WordPress dashboard or download the release directly from WordPress.org. WordPress backported the fix to every branch still eligible for security fixes as far as 4.7 to address the critical path traversal vulnerability.

    Technical Details

    WordPress Core is vulnerable to Local File Inclusion via the template loading functions in versions up to and including 7.1.1. The function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, so a template name containing .. could resolve to a readable PHP file outside the active theme and be included.

    The bug is simple, and is at its core a missing validation check on HTTP parameter data. WordPress is open source, and we can easily view a vulnerable version of the code on the WordPress github.

    In that version of the code base, in /wp-includes/template.php, line 487 is the affected line of code:

    $templates = array();
    if ( $template && 0 === validate_file( $template ) ) {
    $templates[] = $template;
    }
    if ( $pagename ) {
    $pagename_decoded = urldecode( $pagename );
    if ( $pagename_decoded !== $pagename ) {
    $templates[] = "page-{$pagename_decoded}.php";
    }
    $templates[] = "page-{$pagename}.php";
    }

    Proper validation checks are applied to the $template variable, but not to the $pagename variable, which is attacker-controlled. That variable is then prepended with “page-“, and appended with “.php” to create a URL to redirect to.

    An attacker can thus inject a traversal string in the middle of that string and call any arbitrary .php script on the server. Depending on what is available, this can easily lead to remote code execution.

    How Beazley Security is responding

    Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

    We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

    If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

    Sources