Critical Security Alert: Update to WordPress 7.1.2 Immediately
WordPress 7.1.2 Patches High-Risk Unauthenticated Path Traversal Flaw
WordPress has officially released version 7.1.2, addressing a critical security vulnerability rated 9.2 on the CVSS scale (CVE-2026-87902 / GHSA-7hp8-65ch-5whp). All site administrators are strongly advised to update immediately.
What Is the Vulnerability?
Discovered and reported by security researcher Robert Ressl, the flaw involves an unauthenticated path traversal mechanism in WordPress's page-template resolution process (get_page_template()).
Under specific conditions, an unauthenticated attacker can manipulate template loading to execute arbitrary local PHP files outside active theme directories. When combined with specific server setups—such as PHP running with register_argc_argv enabled — this path traversal can escalate into full Remote Code Execution (RCE).
Who Is Affected?
Sites are vulnerable if they meet specific prerequisites, including:
Themes: Using themes with top-level directories starting with page- (e.g., page-templates). Affected themes include popular defaults like Twenty Twelve and Twenty Fourteen, along with third-party themes like Neve, Hestia, and Sydney.
Environments: Server setups running official PHP Docker images or default cPanel configurations running PHP versions prior to 8.5.