wordpress.orgadvisoryWordPress 7.1.2 Release (CVE-2026-87902 path-traversal RCE fix)
WordPress 7.1.2 patches CVE-2026-87902 (GHSA-7hp8-65ch-5whp), a critical unauthenticated path-traversal flaw where page template resolution can be manipulated to include an attacker-chosen readable local PHP file outside the active theme directory. Under certain server and active-theme preconditions this local file inclusion escalates to remote code execution. The security fix was backported to all WordPress branches back to 4.7; discovery credited to researcher Robert Ressl.
TL;DR WordPress 7.1.2 fixes an unauthenticated path-traversal bug in template resolution (CVE-2026-87902) that can escalate to RCE.
Organisations named here
- GHSA-7hp8-65ch-5whp
- Ressl
- Robert Ressl
CVEs named here
- CVE-2026-87902
Technologies named here
- WordPress
- PHP
Techniques named here
- Path traversal
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup