What the WordPress 4.7.0 to 7.1.1 file inclusion bug teaches about patch windows

WordPress 7.1.2 was released on 22 September 2026 to fix a remote file inclusion flaw tracked as CVE-2026-87902. The interesting part of this event is not the vulnerability class. It is the timeline. Attack attempts were observed within hours of the patch, and the fix was back-ported to every maintained branch going back to 4.7 [1][2].
According to the project advisory summarized in security reporting, an unauthenticated attacker can manipulate the page template resolution logic in the get_page_template() function so that it includes a readable local PHP file from outside the active theme directory [1][3].

The conditions that turn inclusion into code execution

Public analysis is careful to note two preconditions. The active parent or child theme must contain a top-level directory whose name starts with page-, and the server must host a target PHP file that the web service account can read [1][3].
The example that appears in observed traffic is pearcmd.php, which ships with the PEAR package manager on many Linux distributions. When it is reachable and PHP is configured with register_argc_argv enabled, the inclusion can be turned into writing files into temporary directories and then executing attacker-controlled content [3][4].
Those conditions are restrictive compared with a universally exploitable bug, and reporting reflects that. Honeypot networks operated by the security firm Previdian recorded sixty-eight exploitation attempts against the flaw, with early requests originating from an address in New Jersey and some later traffic from Indonesian ranges [4][5]. Attackers were observed probing with harmless core files first and only then moving to PEAR installation paths, which is the recognizable reconnaissance-into-exploitation sequence.

Why the patch window was effectively zero

The first recorded attempt appeared on the same day the patched version shipped [4]. Automated scanners do not need to understand an organization. They need a list of hosts and a request template, and WordPress provides both because so many sites expose a detectable version.
That has a direct consequence for people who run WordPress. The decision that matters is not whether the bug is exploited in the wild, because the evidence already says it is. The decision is how fast the site can move from the vulnerable version to 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9 or the back-ported 4.7.37 release [3][4].

Mitigations before the upgrade lands

Managed hosting, restrictive file permissions and a staging process all slow a one-click upgrade. Several mitigations reduce exposure in the meantime.
Block path traversal patterns in the pagename parameter at the web application firewall, recognizing that encodings varied widely in observed traffic and a single rule is unlikely to catch every variant [4].
Disable register_argc_argv in the PHP configuration, which breaks the PEAR-based step of the chain while leaving the underlying inclusion defect in place [4].
Check /tmp and /var/tmp for PHP files that no one recognizes. Reporting mentions specific artifacts such as wp-pear-rce-flag.php, poc87902.php and randomly named files with prefixes like luci_ and zeta_ [4].
Audit themes for directories matching the page- pattern, since the official Twenty Twelve and Twenty Fourteen families are among the themes that satisfy that precondition [3].

What the case changes about routine maintenance

Automatic background updates cover security releases on many installations, and reporting credits them with reducing the affected population. The population that remains is the awkward one: sites pinned to an old version, sites with auto-updates disabled by a plugin, and sites whose hosting panel has not refreshed its PHP runtime in years [4].
For defenders, three changes are worth making permanent. Turn on automatic minor and security updates unless a documented compatibility reason prevents it. Keep a list of installed themes and know which ones satisfy the page- directory precondition. Treat temporary directory monitoring as part of incident response rather than as a one-off check after a report like this one.
The vulnerability itself is a reminder that template resolution code sits on the request path for every page view. The response is a reminder that the interval between disclosure and exploitation keeps shrinking.

References

1. FreeBuf, attackers exploit WordPress CVE-2026-87902 within hours of disclosure: https://www.freebuf.com/column/503179.html
2. Tenable vulnerability record noting in-the-wild exploitation of the WordPress Core flaw: https://www.tenable.com/cve
3. Analysis of affected versions and remediation branches for CVE-2026-87902: https://blog.csdn.net/ylscode/article/details/166488284
4. Reporting on observed exploitation technique and temporary mitigations: https://blog.csdn.net/ylscode/article/details/166645724
5. NVD record for CVE-2026-87902: https://nvd.nist.gov/vuln/detail/CVE-2026-87902