Filtered by tag: local file inclusion × Clear
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
Matched: WordPress
WordPress released version 7.1.2 on September 22, 2026, patching a critical unauthenticated path traversal vulnerability (CVE-2026-87902) in Core. Security backports were issued for all branches back to 4.7. The flaw lets attackers include arbitrary local PHP files outside the theme directory, potentially enabling remote code execution on sites using themes with a page- subdirectory and accessible PHP files like pearcmd.php. Wordfence Premium users received firewall protection immediately; free users get it October 22.