WordPress Version 7.1.2 Addresses Critical Vulnerability
WordPress has unveiled version 7.1.2, a crucial update aimed at rectifying a severe path-traversal vulnerability identified as CVE-2026-87902.
This flaw possesses the potential to enable unauthenticated remote code execution (RCE) under particular server and theme configurations. Assigned a CVSS v4 score of 9.2, this vulnerability impacts WordPress iterations as early as version 4.7.
Critical WordPress Flaw
The root of the problem lies in improper page-template resolution within the `get_page_template()` functionality of WordPress.
An unverified remote assailant could exploit this vulnerability by manipulating template resolution, leading WordPress to incorporate a locally accessible PHP file chosen by the attacker, irrespective of its location outside the active theme directories.
This scenario generates a path traversal condition that, under specific circumstances, may escalate to arbitrary PHP code execution on the compromised web server.
This vulnerability has been categorized under CWE-98, which refers to improper oversight of filenames involved in PHP’s include or require operations.
The advisory labels this vulnerability as critical, primarily because its exploitation demands no form of authentication or user interaction, posing a threat to the confidentiality, integrity, and availability of the affected WordPress installation.
Though the potential for exploitation exists, it is conditional and not universally applicable. The advisory outlines two fundamental prerequisites:
- The active parent or child theme must incorporate a top-level directory prefixed with “page-”, such as “page-templates.”
- A local .php file that is readable must exist on the server and be accessible to the web server process.
Noteworthy affected themes include the legacy Twenty Twelve and Twenty Fourteen WordPress themes, as well as several third-party themes like Neve, Hestia, and Sydney.
A particularly alarming exploitation chain involves PHP’s `pearcmd.php`, which could facilitate PEAR-to-RCE behavior if the `register_argc_argv` PHP setting is enabled.
Notably, the advisory specifies that the official PHP Docker image is susceptible to this problem, along with default cPanel configurations utilizing PHP versions prior to 8.5.
This issue is pertinent to WordPress versions 7.1.0 through 7.1.1, in addition to older supported and security-maintained branches down to version 4.7.
WordPress 7.1.2 serves as the principal fixed release, with maintenance updates issued for each applicable branch, including versions 7.0.6, 6.9.9, 6.8.10, and 4.7.37.
WordPress has backported the patch for users employing older branches, though only the latest version remains under active support.
Administrators are urged to promptly update to WordPress 7.1.2 or the most recent patched version accessible for their branch.
Updates can be initiated from the WordPress Dashboard by navigating to Updates → Update Now, while sites with automated background updates enabled should commence updating seamlessly. The latest WordPress package is also available from the official download page.
Site owners are encouraged to scrutinize their active and child themes for “page-*” directories, ensure that readable PHP files like `pearcmd.php` are not inadvertently exposed to the web server account, and deactivate unnecessary PHP settings, including `register_argc_argv`, wherever operationally viable. The vulnerability was responsibly disclosed by security researcher Robert Ressl.
Source link: Gbhackers.com.
