CVE-2026-87902: Critical WordPress Core Flaw Enables Unauthenticated RCE Under Certain Conditions

WordPress issued an emergency update for CVE-2026-87902 — a critical unauthenticated page-template resolution flaw (CVSS 9.2) affecting Core 4.7.0 through 7.1.1 that enables local PHP file inclusion and, when combined with specific theme layouts and server conditions (e.g., readable PEAR components and register_argc_argv enabled), can lead to remote code execution; a public PoC and rapid probing were observed after disclosure, so administrators should apply patched releases (7.1.2 and backports) immediately and search logs and web telemetry for traversal/probing indicators.