Threat Intelligence

WordPress Patches Critical Flaw Allowing Unauthenticated Code Execution on Some Sites

The Hacker News · 23 Sept 2026

Key Takeaway Australian small businesses running WordPress should confirm their site has updated to version 7.1.2 or later immediately, as no workaround exists besides patching.

WordPress has fixed a critical security flaw, tracked as CVE-2026-87902 and rated 9.2 out of 10, that allows an attacker with no account to trick a site into loading a PHP file from outside its normal theme folders. On some servers, this can be escalated into full code execution if a suitable PHP file already exists on the server that performs a useful action when loaded.

The issue affects every WordPress version from 4.7.0 through 7.1.1, including the version released just days earlier on September 17. WordPress shipped fixes for all supported branches back to 4.7.37 on September 22, in version 7.1.2, and has stated there is no workaround other than updating.

The flaw stems from how WordPress builds the name of a template file using part of the web address, without properly checking for directory traversal characters. Exploiting it further requires the active theme to include a folder starting with 'page-', a structure found in some themes, including older WordPress defaults. Sites with automatic background updates should already be patched; others should update immediately via the dashboard or WordPress.org.

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.