Pull to refresh
Logo
WordPress patches critical flaw present in every version since 2016

WordPress patches critical flaw present in every version since 2016

Rule Changes

Unauthenticated file inclusion bug fixed in 7.1.2, backported to all supported branches

Today: WordPress 7.1.2 released

Overview

Updated 2 hours ago

A critical flaw in WordPress core has sat in every release since 2016. On September 22, WordPress shipped a fix in version 7.1.2 — and attackers began probing for vulnerable sites within five hours.

The bug lets an unauthenticated attacker make a site load a PHP file from outside its theme folders. On servers with specific configurations, that becomes remote code execution. WordPress rates the flaw 9.2 out of 10 on the CVSS severity scale.

Why it matters

WordPress runs a large share of the world's websites; a decade-old unauthenticated flaw means millions of sites are exposed until they patch.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

9.2
CVSS severity score
Rated critical by WordPress; the flaw requires no account and no user interaction.
10 years
Duration of vulnerability
Present in every release from 4.7.0 (December 2016) through 7.1.1.
5 hours
Time from patch to first probing
Patchstack logged the first probing attempts at 17:44 UTC on September 22, less than five hours after the fix shipped.
4.7.37
Oldest version with backported fix
WordPress backported the fix to every supported branch down to 4.7.37.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

People Involved

Organizations Involved

Timeline

December 2016 September 2026

5 events Latest: Today
Tap a bar to jump to that date
  1. WordPress 7.1.2 released

    Today Security Release

    Fixes CVE-2026-87902 and backports the patch to all supported branches down to 4.7.37.

  2. Advisory published, CVE assigned

    Today Disclosure

    GHSA-7hp8-65ch-5whp published; CVE-2026-87902 assigned to the flaw.

  3. First probing attempts observed

    Today Exploitation Activity

    Patchstack logs the first probing attempts, less than five hours after the patch shipped.

  4. WordPress 7.1.1 security release

    Security Release

    Fixes separate flaws; the CVE-2026-87902 bug remains unfixed.

  5. WordPress 4.7.0 released

    Release

    Introduces the template-loading code path that would carry the flaw for a decade.

Scenarios

1

Botnets exploit CVE-2026-87902 at scale

Possible Resolves by End of 2026

Discussed by: Patchstack, security researchers

The probing observed within hours of the patch suggests attackers are working from the diff. If they chain the file inclusion with pearcmd.php on servers running register_argc_argv, they can achieve remote code execution. Mass scanning could compromise thousands of unpatched sites before updates propagate.

2

Exploitation stays limited to targeted attacks

Possible Resolves by End of 2026

Discussed by: Patchstack, Hadrian

The conditional nature of RCE — requiring register_argc_argv enabled and a theme with a page- folder — limits the attack surface. Attackers may focus on high-value sites with the right configuration rather than mass scanning.

3

Vulnerability fades without significant exploitation

Unlikely Resolves by End of 2026

Discussed by: WordPress security team

Automatic background updates and the backport to all branches mean most sites patch quickly. The lack of a public proof-of-concept and the conditional RCE requirements may keep exploitation minimal.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

January 2017

WordPress REST API content injection (2017)

A flaw in WordPress's REST API let unauthenticated attackers modify the content of any post or page. It affected every version of WordPress at the time, and the fix required an emergency release.

Then

WordPress rushed out version 4.7.2 within days of disclosure.

Now

The incident showed how a single core flaw can expose every WordPress site simultaneously.

Why this matters now

Like CVE-2026-87902, it was a core flaw present in all versions, unauthenticated, and requiring urgent patching across the ecosystem.

March-April 2018

Drupalgeddon2 (2018)

A critical remote code execution flaw in Drupal core (CVE-2018-7600) let unauthenticated attackers take over sites. Exploitation began within hours of disclosure, and botnets were scanning within a day.

Then

Drupal released a patch, but thousands of sites were compromised before they could update.

Now

It became a benchmark for how fast attackers weaponize critical CMS vulnerabilities.

Why this matters now

Shows the typical exploitation timeline for unauthenticated RCE in a major CMS — and what WordPress may face with CVE-2026-87902.

Sources

(9)