What the advisory actually says
CVE-2026-87902 concerns page template resolution that could include a chosen readable local PHP file outside the active theme directories. On certain combinations of theme layout and server/PHP configuration, this can lead to code execution. WordPress 7.1.2 addressed the issue; later maintenance/security releases should also be evaluated.
This is separate from July's WP2Shell flaw. A WordPress installation updated against the July issue could still have required the September release.
How to check without triggering the flaw
- Record the actual installed WordPress branch/build from the administration panel and compare it against the applicable security release for that branch.
- Review the active theme, custom template structure and hosting configuration with your developer. Do not assume the publicly displayed WordPress version describes the whole environment.
- Take a restorable backup, test the supported WordPress update and dependent theme functionality on staging, then deploy an approved patch.
- If logs indicate suspicious requests or files changed during the exposure window, preserve evidence and review integrity, administrators, file uploads and scheduled tasks before declaring the site clean.
Avoid version-only conclusions
A version fingerprint is useful for prioritization, not proof of exploitability. It does not reveal the full set of server and theme prerequisites. The free site checker should display a possible advisory match and invite verification, not claim a successful attack.
Primary sources and patch references
Verify the latest release and vendor-specific backports before taking action. This guide records information available as of 26 October 2026.
Related security guides
Need a second opinion?
Start with a free public website check or describe the concern. Do not send credentials, raw customer data or full private logs. Any technical work beyond the free enquiry requires an agreed scope.