WordPress 7.1.2 was released on September 22, 2026 as a security update. It fixes CVE-2026–87902, rated 9.2 Critical under CVSS 4.0. The flaw affects page-template handling around get_page_template(). An unauthenticated attacker can influence template resolution and make WordPress load a local PHP file outside the usual theme directory. A readable file in the right environment can turn that inclusion into remote code execution. The issue is classified as CWE-98, which covers unsafe filename control in PHP include operations. The official advisory is available at https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp.

register_argc_argv = Off

Exploitation requires several conditions. The active theme must contain a top-level directory whose name starts with page-. The source example includes functions.php, style.css, page.php and page-templates/. Other possible names include page-layouts and page-builder. The advisory lists Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as themes where this structure can occur. The directory itself does not indicate a compromise.

The server must also expose a readable local .php file through the vulnerable template-loading path. pearcmd.php can form part of an exploitation chain when register_argc_argv is enabled. The advisory specifically mentions the official PHP Docker image and default cPanel configurations running PHP versions below 8.5. The complete RCE path therefore depends on the WordPress flaw, a matching theme structure and suitable PHP/server conditions.

Sites on the 7.1 branch should move to 7.1.2. Older installations should use the corresponding security release for their branch. WordPress backported the fix to branches reaching back to 4.7. The update is available through Dashboard → Updates → Update Now and from WordPress.org at https://wordpress.org/news/2026/09/wordpress-7-1-2-release/.

Setting register_argc_argv = Off can disrupt the pearcmd.php chain. This is a mitigation, not the patch. Administrators should verify the installed version even when automatic security updates are enabled. For sites that ran an affected version, review access logs, recently changed PHP files, unfamiliar administrator accounts, unexpected plugins or themes, and suspicious changes under wp-content.