WordPress 7.1.2 Security Update: A Critical Flaw Was Exploited Within Hours of the Patch

WordPress shipped version 7.1.2 on September 22, 2026, a security-only release with a single fix. Attackers were already exploiting that bug the same day, with the first attempt recorded at 11:49 UTC. By September 25, CISA had added it to its Known Exploited Vulnerabilities catalog with a federal deadline of September 28.

The flaw is tracked as CVE-2026-87902 and scores 9.2 (critical). It is in WordPress core, not a plugin, and it affects every version from 4.7.0 up to and including 7.1.1.

What the bug is

When WordPress picks a template for a page, it builds a file path from the page name. The template slug went through validate_file(), WordPress's own traversal check. The candidate path built from the page name never did.

That let an unauthenticated visitor steer WordPress into including a readable PHP file from outside the active theme. This is a local file inclusion bug. On its own it only runs files already on the server.

When it becomes remote code execution

Reports say exploitation needs two conditions. The active theme must have a top-level directory whose name starts with page-, and the server must have a usable PHP file to point at.

The file attackers are using is pearcmd.php, the PEAR package manager script. With register_argc_argv turned on, it can be abused to write attacker-chosen content to disk, usually in /tmp or /var/tmp. Include that written file, and the attacker is running PHP on your server. register_argc_argv is on by default in PHP before 8.5 and in the official PHP Docker images.

So a default Docker setup is closer to the exploitable path than people expect. Public scanning tools for this bug are already circulating.

The pattern behind it

The bug is a missing check on one code path while a nearby path had the check. Here is the same shape in generic form:

// Broken: the user-controlled name is never checked
const file = path.join(themeDir, `page-${req.query.name}.php`);
include(file);

// Fixed: resolve the real path, then confirm it stays inside themeDir
const file = path.resolve(themeDir, `page-${req.query.name}.php`);
if (!file.startsWith(themeDir + path.sep)) throw new Error("bad path");
include(file);

The WordPress fix works the same way. It validates the decoded value and adds a gate that rejects .. and requires realpath() to land inside the theme directory.

This is a common failure in any app that builds a file path from user input, including code generated by AI tools. The check exists in one handler and is missing in the next.

What to do now

First, update. Patched versions are 7.1.2, 7.0.6, 6.9.9 and 6.8.10. If auto-updates are on, confirm the update actually landed instead of assuming it did.

Second, look for signs of a hit. Researchers list files such as wp-pear-rce-flag.php, poc87902.php and luci_* or zeta_* files with random suffixes in /tmp and /var/tmp. Check web server logs from September 22 onward for odd page name requests containing .. or pearcmd.

Third, shrink the blast radius. If you do not need register_argc_argv, turn it off. Remove pearcmd.php from production images when nothing uses it.

The bigger lesson is the timing. The window between a patch and active exploitation was hours, so "we patch monthly" is no longer a plan for internet-facing software.

Checking your own app

You may not run WordPress at all. Many AI-built apps still read files, serve downloads, or load templates based on a URL value. Search your code for every place a request value ends up in a file path, and confirm each one resolves inside the directory you intended. If you want a second pair of eyes, the free assessment is a quick way to find out whether your app has this kind of gap.

VibeAudits audits apps built with Cursor, Lovable, Bolt, Claude Code, Replit, and other AI tools.