CVE-2026-87902 in WordPress Enables Conditional RCE

CVE-2026-87902 is a critical unauthenticated path-traversal vulnerability in WordPress page-template resolution that can produce local file inclusion and, in certain server/theme configurations, lead to remote code execution; WordPress released fixes (7.1.2 and backports) on Sept 22, 2026, a public PoC was published, and rapid scanning/probing was observed shortly after disclosure — administrators should patch, assess theme/PHP prerequisites, hunt logs for probing, and apply compensating controls if immediate updates aren’t possible.