WordPress shipped 7.1.2 on September 22, 2026, and the announcement describes it in one line: a security release that "features a fix for a critical severity security vulnerability". The matching GitHub advisory is GHSA-7hp8-65ch-5whp, the bug is CVE-2026-87902, and its CVSS v4 score is 9.2. Three days later, on September 25, the US agency CISA added it to the Known Exploited Vulnerabilities catalog "based on evidence of active exploitation", giving federal agencies until September 28 to deal with it.

What the Bug Is, and When It Leads to Code Execution

In the official wording, an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories; if the pre-conditions in both the server environment and the active theme are met, this can lead to remote code execution. The advisory lists two kinds of pre-condition:

  • The theme: the active child or parent theme contains a top-level directory whose name starts with page- (for example page-templates). The advisory names the legacy Twenty Twelve and Twenty Fourteen themes and popular third-party themes such as Neve, Hestia and Sydney.
  • The server: a usable local PHP file exists and is readable by the web server account. The advisory's example is pearcmd.php, which can be turned into code execution when register_argc_argv is On. It states that the official php Docker image is affected, as is the default cPanel configuration when PHP before 8.5 is in use.

Affected and Fixed Versions

Every branch from 4.7.0 through 7.1.1 is affected. The fix has been backported to all branches still receiving security fixes: 7.1.2, 7.0.6, 6.9.9 and so on down to 4.7.37. Whatever major version you are on, there is a fixed release for it; what matters is confirming it is actually installed.

Two More Security Releases Either Side

This was not a one-off. 7.1.1 on September 17 carried 11 security fixes, and 7.1.3 on October 6 fixed another 7 security issues. All three announcements say that sites supporting automatic background updates will start updating automatically. On a server you manage yourself, though, automatic updates can be switched off by file permissions or configuration, so don't assume yours already ran.

How to Check on a VPS

  • Check the version: Dashboard → Updates, or on the server run wp core version with WP-CLI. If you are below your branch's fixed release (on the 7.1 branch, below 7.1.2), update now; with 7.1.3 already out, going straight to 7.1.3 on the 7.1 branch saves a step.
  • Check the theme directories: under wp-content/themes/, look in the root of the active theme (and its parent) for directories whose names start with page-.
  • Check PHP: confirm the register_argc_argv value in the PHP your site actually runs (FPM or the Apache module, not the command line), and whether an unneeded pearcmd.php sits on the server. If you run the site on the official php Docker image, check this in particular.
  • If you suspect exploitation: sites that were only updated after September 22 should go through the post-compromise checklist, looking for unfamiliar PHP files, scheduled tasks and administrator accounts.

For the basics of running WordPress, see building a WordPress site on a VPS; take a backup first using VPS backup strategies; and while you are at it, review your ufw firewall and SSH key login.