Ethical Hacking News
WordPress has released a critical security patch for a flaw that can enable code execution on some servers. The patch, which was released on September 22, 2026, aims to prevent an attacker with no account from making a site load a PHP file from outside its theme folders. WordPress is urging site owners to update their software to the latest version, which is 7.1.2, as the latest branch supported by the project that still receives security patches.
A critical security vulnerability, CVE-2026-87902, was discovered in WordPress, allowing code execution on affected servers. The vulnerability was rated as critical with a CVSS score of 9.2 and was discovered by Robert Ressl. The flaw lies in how WordPress chooses the template file for a page, allowing an attacker to load a local PHP file. The severity of the vulnerability depends on the server configuration, and code execution is only possible if the server has a useful PHP file. Security vendor Patchstack analyzed the vulnerability and provided checks to indicate how exposed a site is to the worst-case scenario. WordPress recommends updating to version 7.1.2, the latest branch supported by the project that still receives security patches. Site owners are urged to update their software as soon as possible, although there is no public proof-of-concept exploit or reports of the flaw being used in attacks.
A recent patch by WordPress has addressed a critical flaw in its core software that could enable code execution on some servers. This security vulnerability, identified as CVE-2026-87902, was rated as critical by WordPress and has a CVSS score of 9.2. The patch, which was released on September 22, 2026, aims to prevent an attacker with no account from making a site load a PHP file from outside its theme folders.
The critical flaw was discovered by Robert Ressl, who credited WordPress with acknowledging his discovery. The vulnerability lies in how WordPress chooses the template file for a page. Specifically, the software builds a file name that includes part of the web address, which on affected versions did not undergo a check for ../ traversal steps. This allowed an attacker to load a local PHP file, which could potentially run the attacker's code.
However, the severity of the vulnerability depends on the server configuration. On some servers, the attacker could run their own code, potentially leading to code execution. This is because the server must already have a PHP file that does something useful when loaded. This condition was necessary to turn the local PHP file loading into code execution, which is why the flaw does not affect every affected site.
Security vendor Patchstack analyzed the vulnerability and found two checks that could indicate how exposed a site is to the worst case. The first check is whether the active theme has a top-level folder whose name begins with page-, and the second check is whether PHP is running with a setting called register_argc_argv turned on. Neither of these checks is a fix, but they do indicate how close a site is to the worst-case scenario.
WordPress has recommended that site owners update their software to the latest version, which is 7.1.2, as the latest branch supported by the project that still receives security patches. Sites with automatic background updates enabled will start the update automatically. Others can update from the dashboard under Updates, or download the release from WordPress.org.
The vulnerability was not immediately exploitable, with no public proof-of-concept exploit or reports of the flaw being used in attacks. However, WordPress is urging site owners to update their software as soon as possible.
Related Information:
https://www.ethicalhackingnews.com/articles/WordPress-Security-Patch-Critical-Flaw-Enables-Code-Execution-on-Some-Servers-ehn.shtml
https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
https://nvd.nist.gov/vuln/detail/CVE-2026-87902
https://www.cvedetails.com/cve/CVE-2026-87902/
Published: Tue Sep 22 15:25:41 2026 by llama3.2 3B Q4_K_M
