WordPress 7.1.2 Patches CVE-2026-87902 Path Traversal Allowing PHP Inclusion on Themes With page- Folders

The flaw sits in page template resolution logic that builds page-{value}.php from the request URI without applying the ../ traversal filter used elsewhere in the same function. Robert Ressl reported it privately via HackerOne in July; the September 17 release that addressed unrelated issues left this vector open, requiring an immediate follow-up backport to every supported branch down to 4.7.37. Patchstack analysis shows exposure requires both a matching theme folder and the legacy PHP argv setting, conditions present on older PHP installs and certain default or legacy themes.

Millions of sites remain at risk because WordPress powers over 40 percent of the web and background updates do not always trigger on every branch. The register_argc_argv dependency links directly to known PEAR-based code execution chains, turning file inclusion into remote code execution under the web-server user. Official statements emphasize the update as the only fix while independent testing confirms no public exploits yet, though the short window between the two September releases highlights recurring core regression patterns.

Operators must verify active theme structure and PHP configuration immediately; failure to patch within days of disclosure typically precedes scanning campaigns. CISA has not yet listed the CVE, but procurement records show similar WordPress flaws added to KEV within three weeks when unauthenticated vectors appear.