DEV Community

StarkMan
StarkMan

Posted on

CVE-2026-87902 Patch Matrix: Which WordPress Branches Received the Backport

#security #wordpress #vulnerability #rce

CVE-2026-87902 Patch Matrix: Which WordPress Branches Received the Backport

Vulnerability overview

WordPress fixed CVE-2026-87902 in version 7.1.2 on 22 September 2026 and, unusually, pushed the correction back through a long list of maintained branches. CVE-2026-87902 is an unauthenticated local file inclusion flaw in core template resolution and is rated 8.1 on CVSS v3.1. For administrators the practical question is which exact release closes the hole on their branch.

Mechanism and exploitation conditions

The defect lives in get_page_template(). A crafted pagename value containing a double-encoded traversal survives early sanitisation, is decoded during template candidate construction, and can point at a readable PHP file outside the active theme directories. The loader accepts it because it verifies only existence, readability and the .php or .html suffix. Exploitation into full remote code execution also depends on the active theme and on server configuration, particularly whether register_argc_argv is enabled.

Impact

Unpatched installations accept anonymous requests that read local files, and under the right theme and PHP settings the same class of request can run attacker-chosen code. CERT-In frames the impact as arbitrary code execution, information disclosure and complete system compromise. Patchstack observed scanners probing sites within hours of the patch, which means the window between disclosure and attack traffic is measured in hours rather than weeks.

Affected products and scope

The current release is 7.1.2. CERT-In enumerates the backported maintenance versions as 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32 and 4.7.37. Anything older than 7.1.2 without the matching backport remains exposed. CERT-FR and NCSC-NL both describe the affected range as versions before 7.1.2.

Exposure context

Exposure measured through ZoomEye shows 7,991,549 assets matching app="WordPress" and 0 matching vul.cve="CVE-2026-87902". Because the product fingerprint cannot distinguish version, and the CVE fingerprint has not been populated, the only reliable patch matrix is the vendor's own release list. Operators should record the exact maintenance version installed per site rather than assuming an automatic update completed.

Remediation and mitigations

Update to 7.1.2, or to the backported release for the branch in production. Verify the resulting version from the dashboard and from the version file. Where automatic updates are disabled, add a reporting check so that unpatched instances surface in the next inventory sweep. Re-test any custom template logic that manipulates the pagename parameter.

References

Top comments (0)