WordPress 7.1.2 fixes remote file inclusion flaw as in-the-wild attacks begin

A patch spanning nine years of releases

WordPress released version 7.1.2 on 22 September 2026 to fix a remote file inclusion vulnerability tracked as CVE-2026-87902. According to a dev.to analysis of the release, the flaw reaches every version from 4.7.0 through 7.1.1, and the project back-ported the fix across its maintained branches: 7.0.6, 6.9.9, 6.8.10, 6.7.9 and a 4.7.37 release for installations still on the 4.7 series.

The timeline matters more than the vulnerability class. Security reporting cited on dev.to, including FreeBuf, recorded attack attempts within hours of the patch, and the first logged attempt arrived on the same day the fixed version shipped.

How the inclusion bug works

According to the project advisory as summarized on dev.to, an unauthenticated attacker can manipulate the page template resolution logic in the get_page_template() function so that WordPress loads a readable local PHP file from outside the active theme directory.

Two preconditions determine whether the inclusion escalates to code execution, and public analysis flagged both:

• The active parent or child theme must contain a top-level directory whose name starts with page-.
• The server must host a target PHP file that the web service account can read.

The file seen in observed traffic is pearcmd.php, which ships with the PEAR package manager on many Linux distributions. When that file is reachable and PHP runs with register_argc_argv enabled, the inclusion can be used to write files into temporary directories and then execute attacker-controlled content. The official Twenty Twelve and Twenty Fourteen theme families are among the themes that satisfy the page- directory precondition, so exposure is not confined to custom theme work.

Exploitation logged the same day the fix shipped

Honeypot networks operated by the security firm Previdian logged 68 exploitation attempts against the flaw, with early requests coming from an address in New Jersey and later traffic from Indonesian ranges, according to the dev.to write-up. The traffic followed a familiar arc: probes using harmless core files first, then requests aimed at PEAR installation paths.

The preconditions make this less severe than a universally exploitable bug, but that distinction no longer buys defenders much time. Automated scanners only need a list of hosts and a request template, and WordPress sites frequently expose a detectable version.

Mitigations while an upgrade is scheduled

The dev.to analysis lists measures that reduce exposure before the version bump lands:

• Block path traversal patterns in the pagename parameter at the web application firewall. Encodings varied widely in the observed traffic, so a single rule is unlikely to catch every variant.
• Disable register_argc_argv in the PHP configuration. This breaks the PEAR-based stage of the attack chain while leaving the underlying inclusion defect untouched.
• Inspect /tmp and /var/tmp for PHP files nobody recognizes. Reporting names specific artifacts, including wp-pear-rce-flag.php, poc87902.php and randomly named files with prefixes such as luci_ and zeta_.
• Audit installed themes for directories matching the page- pattern.

Why it matters

For widely deployed software, the patch window has effectively collapsed. A fixed release doubles as a public description of the vulnerability, and scanners work through host lists rather than knowledge of any specific organization. Administrators are no longer deciding whether the flaw is being exploited — the honeypot data answers that — but how fast their sites can reach a fixed release.

Automatic background updates cover security releases on many WordPress installations and are credited in the reporting with shrinking the affected population. What remains are the awkward cases: sites pinned to old versions, installs where a plugin has switched auto-updates off, and hosting stacks whose PHP runtime has not been refreshed in years.

Three habits are worth adopting permanently, per the dev.to analysis: enable automatic minor and security updates unless a documented compatibility reason forbids it; keep an inventory of installed themes and flag those with page- directories; and treat temporary-directory monitoring as a standing part of incident response rather than a one-off check after each advisory.