WordPress Core 7.1.2: Template Resolution Path Traversal to RCE

Threat Overview

A critical flaw residing directly within WordPress core was exploited in the wild within hours of public disclosure. Tracked as CVE-2026-87902, this path traversal vulnerability in the core template resolution engine allows remote, unauthenticated attackers to execute arbitrary PHP code directly on the underlying hosting server without requiring login credentials or administrative interaction. The vulnerability affects every WordPress branch from 4.7.x through 7.1.1.

The Breakdown: How the Exploit Works

The flaw exists within the get_page_template() function, which resolves which template file renders a requested page. When resolving template paths, the function fails to adequately sanitize directory traversal sequences when specific theme directory naming conventions are met.

An unauthenticated attacker sends a crafted request that causes the template resolver to look outside the active theme directory and include an arbitrary readable local PHP file on the server. When combined with common server environment configurations—such as standard command-line tools or legacy helper files residing on the filesystem—the inclusion triggers a code execution transition. This allows the attacker to execute arbitrary system commands under the permissions of the web server process.

The Operational Risk: What an Attacker Gains

Because this defect lives in core code rather than an optional third-party plugin, every unpatched WordPress installation matching the server prerequisites is exposed to immediate, automated compromise.

Automated threat actors scan web ranges for vulnerable template handlers. Upon locating a susceptible server, they execute payloads that inject persistent backdoors, install unauthorized administrator accounts, access internal database credentials, and compromise customer transaction logs. Because exploitation occurs on standard page requests, legacy firewalls that inspect only form inputs or login pages often fail to intercept the attack.

Our Take in Plain English

“When your website relies on a monolithic dynamic runtime, core functions that decide how pages render can be tricked into running attacker code on your physical server. Business owners should not have to scramble to apply emergency core patches every time a template parser breaks. Modern pre-rendered edge architecture compiles content into static assets distributed globally across cloud networks, eliminating the web server execution layer and neutralizing remote code execution entirely.”

The Modern Architectural Remedy

• Legacy Dynamic Platform: Executes dynamic template resolution and PHP file inclusion on every incoming page request, creating ongoing exposure to server-side traversal vulnerabilities.
• Modern Pre-Rendered Architecture: Pre-compiles all layouts and templates at build time into immutable static assets, deploying them to global edge networks with zero server runtime to exploit.

Immediate Action Items for WordPress Operators

1. Update Core Immediately: Upgrade WordPress to version 7.1.2 or apply the official security backport for your active release branch immediately.
2. Scan Server Files: Inspect system directories for newly modified PHP scripts or unauthorized webshells created during recent exploitation waves.
3. Audit User Roles: Check the WordPress users list for unauthorized administrator profiles created without staff consent.
4. Harden PHP Configurations: Disable register_argc_argv in server php.ini configurations where possible to mitigate command execution transitions.