Loading story…
WordPress released version 7.1.2 to fix critical vulnerability CVE-2026-87902 / GHSA-7hp8-65ch-5whp, an improper filename-validation flaw (CWE-98) in get_page_template(). Under specific server and active-theme conditions, an unauthenticated attacker can influence page-template resolution to include a readable local PHP file outside the active theme directory, potentially resulting in remote code execution.
Exploitation requires the top-level directory for the selected template to begin with page-, a condition reported in the Twenty Twelve and Twenty Fourteen themes as well as some third-party themes. The flaw carries a CVSS score of 9.2; administrators should update immediately to 7.1.2 or ensure automatic updates are enabled. Fixes are also being backported to security-supported WordPress releases from version 4.7 onward.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-87902 Nuclei YAML template was revised to document and detect URL-encoded traversal through the WordPress pagename parameter, which can reach wp-links-opml.php via template resolution. The refactor improved the template's description, impact, remediation, flow, and matchers.
A ProjectDiscovery Nuclei Templates pull request added a template for WordPress CVE-2026-87902, characterized as a path-traversal issue. GitHub Actions assigned DhiyaneshGeek and requested review from theamanrawat for commit abfe901.
WordPress released version 7.1.2 to remediate CVE-2026-87902 (GHSA-7hp8-65ch-5whp), a critical improper filename-validation flaw in get_page_template() with a reported CVSS score of 9.2. Under required server and theme conditions, an unauthenticated attacker could include a readable local PHP file outside active theme directories, potentially enabling remote code execution; WordPress also began backporting fixes to supported branches through version 4.7.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcethehackernews.com
Open sourcewordpress.org
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A WordPress Core theme-preview selector-injection flaw, dubbed **Click2Shell**, can be exploited through a crafted link visited by a logged-in administrator. The attack silently installs an attacker-selected inactive theme from the official WordPress.org directory; if that theme exposes insecure pre-activation functionality, the attacker can achieve remote code execution. Researchers demonstrated the chain using Mobile Repair Zone 2.5.4, whose Customizer-preview AJAX handler could download, unpack, and execute attacker-controlled PHP. No in-the-wild exploitation was reported at disclosure. WordPress addressed the Core flaw in version **7.1.1**, including changeset `63664`, and administrators should update immediately. A proposed Nuclei template, `wordpress-click2shell`, detected the issue on a tested WordPress 7.1 container image and did not flag WordPress 7.1.1, providing a means to identify unpatched deployments. Organizations should also review administrator session protections and restrict unnecessary themes and theme-installation privileges, since exploitation depends on an administrator loading the malicious URL.
Sep 22, 2026
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026