WordPress shipped version 7.1.2 on 22 September with security backports for every branch back to 4.7, and the reason for that unusually long tail is a flaw anyone on the internet can reach. No account, no phishing link, no second bug required. A crafted page request can make WordPress load a PHP file from outside the active theme's directory.
That is a file inclusion, not an automatic site takeover. Whether it becomes code execution depends on what else is already sitting on the server.
The vulnerability is tracked as CVE-2026-87902. Robert Ressl reported it, and Alex Thomas of Wordfence published the breakdown on the day the fix landed. Wordfence puts the CVSS v4.0 score at 9.2, critical, while its own vulnerability database record rates the issue 8.1, high.
One decode too many
WordPress picks a template for every page by walking a list of candidate filenames. In affected releases, get_page_template() took the pagename value out of the URL and ran urldecode() on it a second time, after WordPress had already decoded the request once. A doubly encoded value therefore became path traversal syntax, the dot-dot-slash notation that climbs a directory tree, only as the template name was assembled.
locate_template() then joined that candidate to the active theme's path, confirmed a file existed there, and handed it to load_template(). What it never checked was whether the resolved file was still inside a theme directory. Wordfence says it reproduced the behaviour end to end on WordPress 7.1.
Your theme decides how bad this gets
WordPress adds the page- prefix and the .php suffix itself, so two things must line up before the inclusion becomes remote code execution. The active parent or child theme needs a top-level directory whose name starts with page-, and the server needs a readable .php file that does something useful when included.
Neither is exotic. The advisory names the legacy Twenty Twelve and Twenty Fourteen themes, plus Neve, Hestia and Sydney, as examples carrying that layout, and reports that the official PHP Docker image and default cPanel configurations on PHP before 8.5 can expose a known PEAR-based route from file inclusion to code execution. It publishes no affected theme-version ranges, so Wordfence's advice is to check the installed theme and the filesystem rather than judge exposure from a theme's name.
A site that fails those conditions is not patched, just currently awkward to exploit. Themes and server settings change. The traversal stays until core is updated.
Update to 7.1.2, or the backport for your branch
The fixed versions are branch specific, so "7.1.1 and earlier" is the wrong mental model: the 22 September backports carry numbers that sort below 7.1.1 and are fixed. Current-branch sites want 7.1.2, 7.0 sites want 7.0.6, 6.9 sites want 6.9.9, and the ladder runs down to 4.7.37. WordPress.org calls the older fixes courtesy backports and maintains only the newest 7.1 release, so an old branch should be updated now and moved to a maintained one soon after.
Then confirm it worked, rather than assume a background auto-update succeeded everywhere. Wordfence Premium, Care and Response customers got a firewall rule on 22 September, the day of disclosure, and free users get it on 22 October under the standard 30-day delay. It catches traversal syntax in the pagename input, including the encoded form that survives a firewall's first decoding pass, and Wordfence is explicit that it does not replace the update.
Logs are worth a pass too: traversal-like values in the pagename parameter are the signature, and a hit means treating the site as compromised rather than merely probed.
Two core holes in five days
This is the second WordPress core release inside a week to close a route from an unauthenticated request to attacker-controlled code. On 17 September, 7.1.1 fixed the Click2Shell chain that turned one administrator's click into a web shell. That one needed somebody logged in to open a link. This one needs nobody at all.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.