If you run a WordPress site, a recently disclosed vulnerability is already being used in targeted attacks. CVE-2026-87902 is a critical flaw in WordPress core page-template resolution that could allow an unauthenticated attacker to execute code on your server under certain conditions.
What happened
The issue affects how WordPress resolves page templates. When specific preconditions are met, an attacker could cause the site to include a local PHP file outside the active theme, which can lead to remote code execution. WordPress released version 7.1.2 with a fix, and security researchers noted exploitation began within hours of disclosure. The fix has also been backported to older WordPress branches where feasible.
Why this matters
For regular users, small businesses, creators, and IT teams, this isn’t a theoretical risk. An unpatched WordPress site can be compromised, potentially leading to defacement, data exposure, or a full site takeover. WordPress powers a large portion of the web, so attackers often scan for this kind of vulnerability and attempt automated compromises as soon as patches are available.
Practical steps you can take
- Update now: Apply WordPress 7.1.2 or newer to ensure the fix is in place.
- Limit write access: Check file permissions for wp-content and the active theme directory. Consider restricting PHP file writes in these locations where possible.
- DISALLOW_FILE_EDIT: Add define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php to prevent edits via the dashboard.
- Enable a Web Application Firewall (WAF): If you use a WAF or security plugin, ensure it’s configured to block unusual template inclusion requests and directory traversal patterns.
- Monitor and audit: Review access logs for unusual GET requests that look like template resolution attempts or local file access patterns. Look for requests aimed at /wp-content/* or /wp-admin/* paths with traversal-like parameters.
- Have a recovery plan: Maintain trusted backups and verify site integrity after patching. Consider a quick integrity check of themes and plugins.
Final thought
Patch promptly, monitor your logs, and tighten your WordPress defenses. If you’re unsure how to apply the patch or validate your site’s security, reach out to your hosting provider or a security professional. Staying proactive today helps reduce the risk of a painful incident tomorrow.