CVE-2026-87902: WordPress Core File Inclusion to RCE, Exploited (Update to 7.1.2)

Published 2026-10-08 · Last updated 2026-10-08

What the bug is

When WordPress shows a page, get_page_template() builds a list of template filenames to try, such as page-about.php and page.php. One of those names comes from the pagename value in the request, and it wasn’t validated. A crafted value can steer WordPress into including a .php file outside the theme directory.

Including an arbitrary existing PHP file becomes remote code execution when the right file is lying around. The reporter showed two conditions that together make it work:

• Theme: the active theme (or its parent) has a top-level directory whose name starts with page-. Several popular themes do, including Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney.
• Server: a usable PHP file is readable. The classic is PEAR’s pearcmd.php with register_argc_argv enabled, which is the default in Docker’s official PHP image and in default cPanel setups on PHP before 8.5.

Am I affected?

Check your version under Dashboard → Updates, or with WP-CLI:

wp core version

Then check the two RCE preconditions:

# Theme: any top-level "page-*" directory in the active theme or its parent?
wp theme list --status=active,parent --field=name
ls -d wp-content/themes/<theme>/page-*/ 2>/dev/null

# Server: is register_argc_argv on, and is pearcmd.php present?
php -i | grep register_argc_argv
find / -name pearcmd.php 2>/dev/null

Even if both checks come back clean, update. File inclusion bugs often find new gadgets after disclosure.

How to patch

Sites with automatic background updates (on by default for minor releases) should already have received the fix for their branch. Confirm. Don’t assume.

wp core update
wp core version

Branch	Fixed	Branch	Fixed
7.1	7.1.2	6.4	6.4.12
7.0	7.0.6	6.3	6.3.12
6.9	6.9.9	6.2	6.2.13
6.8	6.8.10	6.1	6.1.14
6.7	6.7.9	6.0	6.0.16
6.6	6.6.9	5.x / 4.7–4.9	see advisory (back to 4.7.37)
6.5	6.5.12

If you can’t update immediately

• Set register_argc_argv = Off in php.ini (or your PHP-FPM pool) and restart PHP.
• Remove PEAR if you don’t use it, or at least make pearcmd.php unreadable by the web server user.
• Enable a WAF rule for CVE-2026-87902 if you use Wordfence, Patchstack, Cloudflare, or Sucuri.

Was my site hit?

• Search access logs for unusual pagename= values containing ../ or encoded variants (%2e%2e), and for requests mentioning pearcmd.
• Look for new PHP files in wp-content/uploads/, /tmp, or theme folders: find wp-content -name '*.php' -newer wp-config.php.
• Check for admin users you didn’t create: wp user list --role=administrator.
• Verify core files: wp core verify-checksums.

Sources

• WordPress security advisory GHSA-7hp8-65ch-5whp
• CVE-2026-87902 (CVE.org)
• CISA Known Exploited Vulnerabilities catalog (added 2026-09-25)

← Back to Knowledge Base