WordPress 7.1.2 fixes get_page_template() RCE flaw

WordPress 7.1.2, released on September 22, 2026, fixes a flaw that can let an attacker run code on a site without logging in. The bug sits in get_page_template(), the function that picks which template file renders a page. It affects every WordPress version from 4.7 onward, so almost any site still receiving updates needs this one.

The WordPress 7.1.2 security release post tracks the bug as CVE-2026-87902 and GHSA-7hp8-65ch-5whp. It tells site owners plainly: "Because this is a security release, it is recommended that you update your sites immediately."

What the vulnerability does

The flaw is in page-template resolution. That is the step where WordPress decides which PHP file from the active theme should draw a page.

According to the release post, an attacker can steer that step so it loads a PHP file of their choosing. The file must already be readable on the server, but it can sit outside the active theme's folder. Loading and running an arbitrary PHP file is what makes this remote code execution, or RCE.

LWN.net's report describes it as a path traversal bug. Path traversal is a class of flaw where crafted input walks out of the folder a program meant to stay in. LWN says the attacker does not need an account, "in some limited circumstances."

Who is exposed

Not every site is exploitable. The release post says an attack needs "specific server environment and theme conditions." Neither source lists those conditions in detail.

Item	Detail
Fixed release	WordPress 7.1.2, September 22, 2026
Identifiers	CVE-2026-87902, GHSA-7hp8-65ch-5whp
Affected	WordPress 4.7 and later
Login needed	No
Condition	Specific server and theme setups
Reported by	Robert Ressl
Release lead	John Blackbourn

The fix has been backported to every branch down to 4.7. The WordPress project notes that only the most recent version is actively supported, so older branches are a courtesy, not a promise.

LWN adds that ClassicPress, a community fork of WordPress, is affected too. Its security update was still pending when LWN reported.

How it was found

Robert Ressl reported the bug through responsible disclosure, the release post says. That means the project heard about it privately and shipped a fix before the details went public. More than 30 contributors worked on the release.

What this means for developers

Update first, investigate second. Check each site's version in the dashboard or with wp core version from WP-CLI, the WordPress command-line tool. Anything below 7.1.2 on the current branch needs the update. Sites pinned to an older branch should move to that branch's latest point release.

Do not assume auto-updates covered you. Automatic updates can be switched off, and staging copies are easy to forget. Check every environment, not just production.

If you build themes, review how your code chooses template files. The bug turns on template resolution reaching files outside the theme folder. Themes that build a template path from request data deserve a second look.

ClassicPress users should watch for their project's own fix, since the WordPress release does not cover the fork. Until it lands, treat those sites as exposed, and limit who can reach them where you can.

Keep an eye on your logs for odd template requests. Now that the fix is public, attackers can study the patch to learn where the weakness was.