WordPress Urges Immediate Updates to Patch Critical Core Flaw Impacting Millions of Sites Worldwide

WordPress has released an urgent security update to address a critical vulnerability within its core software that could allow an unauthenticated attacker to force a website into loading arbitrary local PHP files from outside standard theme directories. Depending on the server configuration and underlying environment, this flaw can escalate into remote code execution, posing a severe risk to millions of website owners, developers, and enterprises relying on the world’s most popular content management system.

The security patch was officially rolled out on September 22 as part of WordPress version 7.1.2. Demonstrating its commitment to maintaining backward compatibility and securing the broader web ecosystem, the project team backported the fix to every active branch still under support, stretching as far back as version 4.7. WordPress is strongly advising all site administrators, system operators, and hosting providers to apply the updates immediately to mitigate potential threats.

Assigned a critical CVSS severity score of 9.2 and tracked under the identifier CVE-2026-87902, the vulnerability requires zero user authentication or interaction from a logged-in user. This means malicious actors can target vulnerable endpoints without needing prior credentials or administrative privileges.

The security defect impacts every WordPress version released from 4.7.0 through 7.1.1. Notably, this includes version 7.1.1, which had only just been deployed during a separate security release on September 17. Consequently, website owners who updated their installations less than a week ago must still perform another immediate update, as CVE-2026-87902 represents an entirely distinct vulnerability independent of previous patches.

Because WordPress does not provide a separate workaround or alternative configuration fix to neutralize the flaw without updating, installing the new software version is the only permanent solution. The required update depends strictly on the specific branch a site is running. Administrators operating on the 7.1.x branch must upgrade to version 7.1.2, those on 7.0.x need version 7.0.6, sites utilizing 6.9.x must move to 6.9.9, the 6.8.x branch requires 6.8.10, version 6.7.x needs 6.7.9, and the 6.6.x branch must update to 6.6.9. Furthermore, WordPress has extended these protections down to legacy branches, with the final supported vintage release updated to version 4.7.37.

Websites equipped with automatic background updates enabled will initiate the upgrade process autonomously. For all other sites, administrators can apply the update directly from the WordPress dashboard under the updates panel or manually download the respective release packages from WordPress.org.

To understand the mechanics of the vulnerability, security researchers explain that the flaw originates within the underlying mechanism WordPress utilizes to select and load template files for specific pages. During normal operations, part of the file name construction is dynamically derived from components of the incoming web request address. In the affected versions, WordPress omitted a crucial security validation check on this incoming value—specifically, the directory traversal prevention check that successfully guards neighboring code against unauthorized path manipulation.

Because the template file name is constructed using a predictable naming convention, a successful attack scenario relies on specific environmental preconditions. Specifically, the target server must host a local PHP file that performs meaningful or exploitable actions when directly executed, and the active theme must contain a top-level folder whose naming structure begins with a specific prefix. While modern default WordPress themes do not include such directories, certain older default themes and custom legacy templates do ship with matching folder structures.

Security vendor Patchstack highlighted in its technical analysis that site owners can gauge their level of exposure by verifying two primary indicators: whether their currently active theme incorporates a top-level directory beginning with the designated prefix, and whether PHP is running with a specific configuration setting known as register_argc_argv enabled. While neither of these observations constitutes a patch or a complete fix, they illustrate how closely aligned a particular server environment is to the worst-case scenario. Notably, this particular PHP setting is disabled by default in newer PHP versions like PHP 8.5, but remains enabled by default across various older PHP installations.

The vulnerability itself was discovered by security researcher Robert Ressl, who responsibly disclosed the flaw through the official WordPress HackerOne bug bounty program this past July. Following the public release of the patch, Ressl published a comprehensive technical write-up detailing the discovery, accompanied by a proof-of-concept exploit demonstration and an isolated test lab environment. In his testing, Ressl demonstrated that a successful exploit executes code strictly under the permissions and privileges assigned to the web server account, rather than granting absolute administrative control over the underlying host machine. All demonstrations were conducted within controlled, isolated local environments running WordPress 7.0.2, rather than against patched software distributions or live production websites.

Ressl also suggested that server operators who find themselves unable to apply the official software updates immediately can temporarily mitigate the vector leading toward potential code execution by explicitly disabling the register_argc_argv configuration parameter for incoming web traffic and removing unused PEAR components from their server environments. However, he emphasized that these tactical adjustments serve merely as defense-in-depth measures and do not repair the underlying software defect.

As of the software release on September 22, industry monitors reported zero active exploitation attempts in the wild. Additionally, the vulnerability had not yet been listed within the United States Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog. Representatives for WordPress and the reporting security researcher were contacted for further commentary regarding the coordinated disclosure.