The Heart Internet Team are aware of a security issue affecting WordPress, and we want to help customers understand what it means, who may be affected, and what sensible steps to take.
This post covers a single critical vulnerability in WordPress core, the software itself rather than a plugin or theme. A fix is already available. Because the flaw affects almost every version of WordPress released in the last decade and needs no login to attack, updating should be a priority for every WordPress site.
What is the Vulnerability?
On 22 September 2026, the WordPress Security Team released WordPress 7.1.2, a security-only update that fixes one issue, tracked as CVE-2026-87902 (GitHub advisory GHSA-7hp8-65ch-5whp). Security researcher Robert Ressl found the flaw and reported it responsibly.
When a visitor requests a page, WordPress works out which template file from the active theme should display it. Part of that process uses the page name from the web address. Before 7.1.2, WordPress did not properly check that value for directory traversal characters, the sequences that let a file path step outside the folder it is meant to stay in. An attacker can craft a web address that makes WordPress load a PHP file from elsewhere on the server instead of a normal theme template. This type of flaw is known as local file inclusion.
On its own, the flaw lets an attacker make WordPress run PHP files that already exist on the server. Whether this goes further, to running the attacker’s own code (remote code execution), depends on how the server and theme are set up. The theme must include a folder whose name begins with page- (for example, page-templates), which several older default themes and a number of popular third-party themes do. The server must also have a suitable PHP file available, together with a PHP setting called register_argc_argv enabled. Patchstack notes that this setting is enabled by default in some common hosting set-ups, so the WordPress Security Team rates the issue as critical.
Within hours of the release, Patchstack saw automated scanning for this flaw. So far, the requests look like attempts to find vulnerable sites rather than attempts to take them over. That usually changes quickly once an issue is known, which is another reason to update promptly.
Affected:
WordPress core versions 4.7.0 to 7.1.1, across every branch in between.
Fixed version:
7.1.2. As a courtesy, the fix has also been backported to every older branch back to 4.7, for example 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.4.12, 6.1.14, 5.9.18, 4.9.33 and 4.7.37.
CVSS:
9.2 (Critical, CVSS v4.0). It can be exploited over the network with no login or user interaction, but it depends on specific theme and server conditions.
What This Means For You:
On shared hosting, the server’s PHP configuration is managed for you, but your WordPress installation and the theme you use are under your control. Check that your site is running WordPress 7.1.2, or the patched release for your branch. Sites with automatic background updates switched on should already have it.
If you run WordPress on a VPS or dedicated server, you are responsible for both WordPress and the server’s PHP configuration. Along with updating WordPress, review whether register_argc_argv needs to be enabled for PHP used by your websites. Switching it off where it is not needed removes the best-known route from this flaw to full code execution.
Recommended Action:
Update WordPress to 7.1.2, or the latest patched release for your branch, as soon as possible. You can do this from Dashboard > Updates in WordPress, through your control panel’s WordPress tools, or by running wp core update on the command line. If you manage many sites, confirm that each one has actually updated, particularly anywhere automatic updates have been switched off or pinned to a specific version.
How to Check If Your Site Has Been Compromised
- Check your WordPress version under Dashboard > Updates, or with wp core version. If it is below the patched release for your branch, update first, then carry on with the checks below.
- If you have access to your website’s access logs, look for requests from 22 September 2026 onwards that include pagename= together with encoded dot sequences such as %252e%252e, or a pagename value beginning with templates%252f. Requests like these are not proof of a compromise, but they show that your site has been scanned.
- Review the WordPress Users screen for administrator accounts you don’t recognise.
- Look for recently added or modified PHP files in wp-content, particularly in the uploads folder, where PHP files would not normally appear.
- Check for unfamiliar plugins, scheduled tasks (cron jobs), or unexpected changes to your site’s content.
- If anything looks suspicious, change your WordPress, hosting, and database passwords, restore from a known clean backup if you need to, and get in touch with our support team.
Frequently Asked Questions
Is this a plugin vulnerability?
My site updates automatically. Do I need to do anything?
I'm on an older version of WordPress. Do I have to upgrade to 7.1?
Is my site definitely at risk of being taken over?
Is anyone actively attacking this yet?
What if I can't update straight away?
Summary Table
| Vulnerability | CVE | CVSS | Affected | Fixed | Action |
| WordPress core page-template path traversal (LFI, conditional RCE) | CVE-2026-87902 | 9.2 | WordPress 4.7.0 to 7.1.1 | 7.1.2 (backports to 4.7.37) | Update WordPress core |
Need Help? Get in Touch
If you have questions about this issue or need help checking your website, you can raise a support ticket through the Customer Area at heartinternet.uk, or chat with our live support team Monday to Friday, 09:30 to 16:00. You can also find step-by-step guides in our knowledge base at heartinternet.uk/support.
We’re here to help keep your website secure.
