Update WordPress to version 7.1.2 to fix RCE vulnerability

This message is intended for U-M IT staff responsible for university websites that run WordPress.

Summary

A remote code execution (RCE) vulnerability in WordPress, CVE-2026-87902, could allow an unauthenticated attacker to read files and, under specific theme and server conditions, execute arbitrary code. Update affected WordPress installations to version 7.1.2 immediately.

Problem

WordPress recently released version 7.1.2 to address a critical path traversal flaw. This WordPress RCE vulnerability allows an unauthenticated attacker to execute arbitrary code under specific server conditions.

Threats

Successful exploitation could allow an unauthenticated attacker to read arbitrary files and, under specific conditions, execute arbitrary code.

No active exploitation in the wild or public proof-of-concept was confirmed by the provided source as of September 22, 2026.

Affected Versions

WordPress versions up to 7.1.1.

Action Items

  • Update WordPress 7.1 installations to version 7.1.2 immediately after appropriate testing.
  • If using an older WordPress release branch, apply the corresponding backported security update.
  • Confirm that the update was successfully installed.
  • Review active themes and server configurations for the reported exploitation conditions.

Technical Details

The vulnerability affects WordPress’s get_page_template() page-template resolution function.

The source reports increased exposure for:

  • Servers using the official PHP Docker image.
  • Default cPanel configurations running PHP versions before 8.5.
  • Themes containing a top-level directory whose name begins with page-. Examples include:
    • Twenty Twelve
    • Twenty Fourteen
    • Neve
    • Hestia
    • Sydney

Questions, Concerns, Reports

Please contact ITS Information Assurance through the ITS Service Center.

References