WordPress CVE-2026-87902: Page Template Path Traversal in CISA KEV

On 22 September 2026 WordPress released 7.1.2, a security release with one critical fix. CVE-2026-87902 lets an unauthenticated attacker make page template resolution include a chosen readable local PHP file outside the active theme directories. Three days later, on 25 September, CISA added it to the Known Exploited Vulnerabilities catalog with a federal due date of 28 September.

Core vulnerabilities in WordPress are rare, and core bugs that lead to code execution without a login are rarer still. This one has preconditions, but the common ones are met by stock Docker images and some popular themes.

What's affected

The advisory, GHSA-7hp8-65ch-5whp, credits Robert Ressl and rates it 9.2 under CVSS 4.0. The fix shipped in 7.1.2 and was backported to every branch back to 4.7. Each branch's fixed release:

Remote code execution needs two conditions, according to the advisory:

• Theme condition. The active child or parent theme has a top level directory whose name starts with page-, such as page-templates. That includes the legacy Twenty Twelve and Twenty Fourteen themes and third party themes such as Neve, Hestia and Sydney.
• Server condition. A readable local .php file exists that turns inclusion into execution. The advisory names the well known pearcmd.php technique, which works when register_argc_argv is On. It says the official php Docker image is affected, as is the default cPanel configuration with PHP older than 8.5.

Without both, the bug is a file inclusion with limited impact. With both, it is unauthenticated RCE.

How to check if you're exposed

Check the core version on every site:

wp core version --allow-root
# or without WP-CLI
grep "wp_version =" wp-includes/version.php

Check whether the active theme meets the theme condition:

THEME=$(wp option get stylesheet --allow-root)
PARENT=$(wp option get template --allow-root)
ls -d wp-content/themes/$THEME/page-*/ wp-content/themes/$PARENT/page-*/ 2>/dev/null

Check the server condition:

php -r 'var_dump(ini_get("register_argc_argv"));'
find / -name pearcmd.php -readable 2>/dev/null

For hunting, the advisory does not publish request patterns. Look for requests in web server logs that mention pearcmd, and for PHP files that appeared recently in directories the web server can write to:

grep -i "pearcmd" /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null
find /var/www /tmp -name "*.php" -newermt "2026-09-20" -type f 2>/dev/null

What to do now

1. Update to 7.1.2 or later. 7.1.3, released 6 October, adds seven more security fixes, so go straight to it if you are on the 7.1 branch. Sites with automatic background updates should already have the fix, but verify rather than assume.
2. If a site can't leave an older branch, install that branch's fixed release from the table. WordPress notes that only the most recent version is actively supported.
3. Set register_argc_argv = Off in php.ini for web PHP, and remove PEAR from production images if nothing uses it. That breaks the known escalation path even if another inclusion bug turns up.
4. Rebuild container images that were based on the official php image. Pin the rebuilt tag so the next deploy doesn't roll back the core version.
5. If hunting turns up unexpected PHP files or pearcmd requests, take the site offline, preserve logs, rotate database credentials and the secret keys in wp-config.php, and reset admin passwords.

Why it matters

The fix itself is small. The exposure comes from where WordPress lives: forgotten marketing microsites, agency built sites on shared hosting, and containers built once and never rebuilt. Background updates help, but a pinned Docker image or a host with updates disabled stays on the vulnerable build until someone notices.

It also shows how environment defaults decide severity. The same core bug is low impact on one host and critical on another, depending on a PHP setting and an unused PEAR install. Hardening those defaults pays off across many future bugs, not just this one.

Try it yourself

Pick one WordPress container image you run and check two things: the WordPress core version baked into it, and whether pearcmd.php is present. If the image ships PEAR and register_argc_argv is on, you have found a hardening task worth doing regardless of this CVE.

This demo walks through scanning a container image for vulnerable components:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-7hp8-65ch-5whp: Unauthenticated path traversal in page-template resolution
• WordPress 7.1.2 Release
• WordPress 7.1.3 Maintenance and Security Release
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2026-87902