This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog late on 25 September 2026 and requires covered federal systems to remediate it by 28 September. CISA lists ransomware use as unknown and marks the entry for forensic triage. WordPress published its critical advisory and version 7.1.2 on 22 September, assigning the flaw a CVSS 4.0 score of 9.2. CISA confirms exploitation, but the cited primary sources do not identify the operators, targets, scale, or observed payloads.
THE TEMPLATE PATH ESCAPED THE THEME — WordPress page-template resolution could accept attacker-controlled path segments and include a chosen readable local .php file outside the active parent or child theme. The request requires no authentication or user interaction. Inclusion alone is not automatically arbitrary code execution, but a suitable local PHP file can turn the traversal into execution under the web server's identity.
RCE DEPENDS ON THE STACK — The official advisory says exploitation requires an active parent or child theme with a top-level directory whose name begins with page-, such as page-templates, plus a readable local PHP target. It identifies Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney as examples of themes meeting the directory condition. One documented path uses PEAR's pearcmd.php and additionally depends on register_argc_argv being enabled; WordPress notes that this setting is enabled in the official PHP Docker image and in default cPanel configurations using PHP before 8.5. Conditional exposure does not make the issue low priority when the exploitation signal is confirmed.
THE FIX REACHED OLD BRANCHES, SUPPORT DID NOT — WordPress 7.1.2 corrects the issue in wp-includes/template.php, and the project backported the fix through the 4.7 branch. Patched maintenance releases include 7.0.6, 6.9.9, 6.8.10, and corresponding releases for older branches. WordPress says automatic background updates should begin where enabled, but operators still need to verify the running version. Releases 4.6 and earlier no longer receive security updates, and remaining on an old maintenance branch preserves broader unsupported-software risk even when this one fix exists.
WHAT TO CHECK — Update to WordPress 7.1.2 or the corrected maintenance release for the installed branch, preferably moving to the latest supported series, and verify the running core version and wp-includes/template.php against a trusted package or official checksums. Inventory active parent and child themes for top-level page-* directories; review PHP configuration for register_argc_argv and the presence of readable helper files such as pearcmd.php. Hunt web logs for traversal-like template requests and pearcmd.php references, then inspect for unexpected PHP files, modified themes or plugins, new administrators, scheduled tasks, and outbound callbacks. If compromise is plausible, preserve evidence, isolate and rebuild from trusted components, and rotate WordPress salts plus hosting, database, administrator, and deployment credentials.