WordPress vulnerability exploited for remote code execution

A critical unauthenticated path traversal vulnerability, identified as CVE-2026-87902, has been discovered in WordPress Core. The flaw allows attackers to use the get_page_template() function to include arbitrary PHP files from outside the active theme directory. Under specific server and theme conditions, this can be escalated to full remote code execution.

Security firm Patchstack reported that malicious requests targeting this flaw began within five hours of the release of WordPress version 7.1.2, which contains the patch. Attackers have progressed from reconnaissance to actively writing files to disks to execute shell commands.

The Uganda National CERT and Coordination Center has issued an advisory, noting that because WordPress is widely used across Uganda’s government, education, and business sectors, sites running versions older than 7.1.2 should be considered actively targeted. Administrators are urged to update immediately and inspect file systems for unfamiliar PHP files outside of active theme folders.