Threat Overview

A critical unauthenticated path traversal vulnerability in WordPress Core enables remote attackers to force WordPress to load and execute local PHP files outside the active theme directory. Tracked as CVE-2026-87902 with a CVSS 9.2 rating, the flaw affects core template resolution routines across multiple active release branches. On web servers running specific theme structures or default cPanel and official PHP Docker container configurations, the local file inclusion can be escalated directly to unauthenticated Remote Code Execution (RCE).

Threat Metric Technical Details
Severity Rating CRITICAL (CVSS 9.2 / 10.0)
Vulnerability Class Unauthenticated Path Traversal / Local File Inclusion (LFI)
Vulnerable Component WordPress Core Template Controller (WP_Theme)
Attack Vector Remote Unauthenticated HTTP Requests

The Breakdown: How the Exploit Works

The vulnerability exists in the way WordPress Core resolves template file paths when handling dynamic web requests.

When a visitor requests a page or REST API template endpoint, WordPress validates the template path to ensure it remains inside an approved theme directory. However, a logic flaw in directory traversal handling permits crafted path parameters containing directory sequence markers (../) to escape the active theme directory.

If an attacker supplies a path targeting a readable PHP file anywhere on the server filesystem—such as a PEAR utility in default PHP Docker images or temporary upload files—WordPress includes and executes that file within the main process context, enabling unauthenticated remote code execution.

The Operational Risk: What an Attacker Gains

Because this flaw resides directly in WordPress Core rather than an optional plugin, every unpatched WordPress website running an affected core branch is vulnerable:

  • Unauthenticated Server Compromise: Attackers trigger local file inclusion without needing login credentials, subscriber accounts, or active user interaction.
  • Broad Environment Impact: Legacy themes (such as Twenty Twelve, Twenty Fourteen, Neve, and Sydney) and standard hosting environments (cPanel, PHP Docker) expose known LFI-to-RCE escalation paths.

Our Take in Plain English

“When a vulnerability is found in a plugin, you can deactivate it. When a vulnerability is found in WordPress Core itself, every site running the dynamic PHP engine becomes a potential target simultaneously. Moving to pre-rendered static delivery eliminates the PHP execution engine entirely from the public web server.”

The Modern Architectural Remedy

  • Legacy Dynamic WordPress: Relies on real-time PHP path resolution and dynamic file inclusion on the live production server, exposing core template routing to path traversal.
  • Modern Pre-Rendered Architecture: Pre-compiles all template paths at build time into immutable static assets hosted on edge CDNs. There is no template controller or dynamic file inclusion mechanism on the live site.

Immediate Action Items for WordPress Operators

  1. Apply Security Updates Immediately: Confirm that your WordPress Core version has updated to 7.1.2 (or 7.1.3), 7.0.6, 6.9.9, or the designated September security backport for your branch.
  2. Rebuild Container Images: For containerized environments, rebuild base PHP Docker images to include the latest system library updates.
  3. Verify Security Backports: Check Site Health inside wp-admin to verify that automatic security updates completed successfully.