Critical WordPress Core Vulnerability (CVE-2026-87902): Unauthenticated Path Traversal and Conditional RCE

The WordPress Core Security Team has published a critical security advisory tracked under GHSA-7hp8-65ch-5whp (assigned CVE-2026-87902 with a CVSS v4.0 score of 9.2).

Published by John Blackbourn (johnbillion, WordPress Core committer and security team member) following a responsible disclosure by security researcher Robert Ressl, the flaw impacts all WordPress Core releases from 4.7.0 through 7.1.1. Nearly a decade of production WordPress deployments shares this vulnerability within its core page-template resolution pipeline.

Below is an engineering breakdown of the root cause, the specific criteria required to escalate from file inclusion to Remote Code Execution (RCE), and immediate hardening steps for systems and backend teams.

---

Understanding the Flaw: Template Resolution in Core

The vulnerability resides within the page-template resolution logic in WordPress Core, specifically in the get_page_template() function located in wp-includes/template.php.

During a standard web request, WordPress determines which PHP file in the active theme is responsible for rendering the requested page. To do so, it evaluates the template hierarchy alongside metadata associated with the post (such as the _wp_page_template postmeta entry):

[Inbound HTTP Request]
          │
          ▼
[WP Query: Parse URL & Template Hierarchy]
          │
          ▼
[get_page_template() in wp-includes/template.php]
          │  (Lacks strict canonical root verification)
          ▼
[File Inclusion via include / locate_template()]

The underlying issue is insufficient path sanitization. Because the resolution routine failed to strictly enforce that the target file path remains within the active theme root directory, an unauthenticated remote visitor can supply path traversal sequences (such as ../ or URL-encoded variations like %2e%2e%2f).

This elevates the template selection mechanism into an unauthenticated Local File Inclusion (LFI) vulnerability requiring zero credentials and zero user interaction.

---

Immediate Threat: Local File Inclusion (LFI)

Through this path traversal, an unauthenticated attacker can coerce PHP into executing any readable local .php file accessible by the web server process (such as www-data).

The highest-value target in virtually every environment is wp-config.php:

• Exposure of database credentials: MySQL hostname, database name, user, and password.
• Leakage of cryptographic keys and salts: AUTH_KEY, SECURE_AUTH_KEY, and LOGGED_IN_KEY, enabling attackers to forge valid authentication cookies and seize administrative control of the WordPress instance.

---

Why is Remote Code Execution (RCE) “Conditional”?

The advisory specifically categorizes the vulnerability as Conditional RCE. For an attacker to bridge the gap between local file inclusion and arbitrary command execution on the host operating system, two environmental prerequisites must be satisfied:

1. Active Theme Directory Structure

The active theme (or active child theme) must contain a top-level directory whose name begins with page- (such as the standard page-templates/ directory).

This convention is widespread across the WordPress ecosystem. Standard core themes including Twenty Twelve and Twenty Fourteen, as well as prominent third-party themes with millions of active sites like Neve, Hestia, and Sydney, satisfy this structural condition out of the box.

2. PHP Runtime Setting (register_argc_argv = On)

The PHP configuration directive register_argc_argv controls whether variables passed via the URL query string are automatically registered into the global $_SERVER['argv'] array, mirroring command-line execution.

When this directive is enabled (On in php.ini), an attacker can leverage the template inclusion path alongside parameter injection into $_SERVER['argv'] to alter runtime behaviors or load injected payloads.

While modern, hardened web server configurations typically disable this flag, it remains enabled by default in:

• Several official base Docker images and development container setups that were promoted to production without hardening.
• Legacy PHP-CGI installations.
• Shared hosting environments where global ini files have not been locked down.

---

The Upstream Fix: WordPress 7.1.2

On September 22, 2026, the WordPress project issued version 7.1.2 addressing this vulnerability. Furthermore, security backports were applied across all maintained older branches dating back to version 4.7 (down to 4.7.37).

The security patch enforces strict canonical path verification:

1. Validates the resolved template path against approved root directories (get_stylesheet_directory() and get_template_directory()).
2. Rejects any input that contains directory traversal segments or resolves outside the active theme file tree.

---

Production Hardening Checklist for Engineers

If you maintain servers, container clusters, or client infrastructures running WordPress, execute the following remediation measures immediately:

1. Upgrade WordPress Core

Update to version 7.1.2 or deploy the corresponding minor security release for your current legacy branch:

# Check current core status via WP-CLI
wp core check-update

# Execute update
wp core update

2. Verify PHP Configuration (php.ini)

Inspect all PHP-FPM pools and container configurations to confirm that register_argc_argv is explicitly disabled:

; /etc/php/8.x/fpm/php.ini
register_argc_argv = Off

Reload the PHP-FPM daemon to apply the change:

sudo systemctl restart php8.x-fpm

3. Edge Mitigation via Reverse Proxy / WAF

If immediate core patching is blocked by legacy dependencies, deploy edge rules in Nginx, Cloudflare, or your perimeter WAF to drop requests containing directory traversal sequences:

# Nginx server block mitigation rule
if ($query_string ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
    return 403;
}

4. Filesystem Least-Privilege Architecture

• Lock down permissions on wp-config.php (chmod 400 or chmod 440), owned strictly by an unprivileged system user.
• Enforce open_basedir restrictions within PHP-FPM pool definitions to prevent the PHP worker process from traversing into system directories outside the designated document root.

---

Architectural Takeaway

CVE-2026-87902 reinforces an enduring truth of systems engineering: critical vulnerabilities frequently hide in mundane, long-standing core routines rather than modern experimental features.

Relying solely on framework-level security is insufficient for mission-critical infrastructure. A rigorous defense-in-depth posture combining container isolation, strict PHP runtime flags, and perimeter inspection ensures that even when an upstream framework encounters an unauthenticated path traversal, the blast radius remains strictly contained.