Full Report
WordPress security advisory (AV26-952)
Analysis Summary
# Morning News Roll-up 2026-09-23
## Overview
A critical security advisory has been issued regarding an actively exploited vulnerability in the WordPress core software. The flaw allows for unauthenticated remote code execution (RCE) via path traversal, affecting a wide range of installations prior to version 7.1.2.
## Top Stories
### WordPress Security Advisory (AV26-952)
- Summary: A critical vulnerability (CVE-2026-87902) has been identified in WordPress versions prior to 7.1.2. The flaw involves unauthenticated path traversal in page-template resolution, which can lead to conditional Remote Code Execution (RCE). Open-source reporting confirms this vulnerability is currently being exploited in the wild.
- Source: hxxps://www[.]cyber[.]gc[.]ca/en/alerts-advisories/wordpress-security-advisory-av26-952
# WordPress Unauthenticated Path Traversal (CVE-2026-87902)
## Main Topic
A critical vulnerability in the WordPress core software involving unauthenticated path traversal during page-template resolution. If successfully exploited, this flaw can lead to conditional Remote Code Execution (RCE), allowing an attacker to execute arbitrary code on the underlying server without requiring prior authentication.
## Key Points
- The vulnerability is tracked as **CVE-2026-87902**.
- It is a **Path Traversal** flaw located in the way WordPress resolves page templates.
- The Canadian Centre for Cyber Security (Cyber Centre) reports that this vulnerability is being **exploited in the wild**.
- The exploit chain allows an unauthenticated user to achieve Remote Code Execution (RCE) under specific conditions.
## Threat Actors
- **Attribution:** Not specifically named in the advisory.
- **Motivations:** Likely include site defacement, data theft, or utilizing compromised servers for malware distribution and botnet activities.
- **Status:** Active exploitation has been confirmed by open-source reporting.
## TTPs
- **Path Traversal:** Attackers manipulate input to traverse directories and access files outside of the intended template directory.
- **Remote Code Execution (RCE):** By resolving a malicious or unauthorized file as a template, attackers execute arbitrary PHP code on the server.
- **Unauthenticated Access:** The attack does not require a valid user account or administrative privileges to initiate.
## Affected Systems
- **Platform:** WordPress Core.
- **Versions:** All versions prior to **7.1.2**.
- **Impact:** Complete system compromise, unauthorized data access, and persistent backdoor installation.
## Mitigations
- **Update Software:** Immediately update WordPress installations to version **7.1.2** or the latest available stable release.
- **Template Security:** Review custom themes and plugins for secure file-handling practices.
- **Monitoring:** Monitor web server logs for suspicious directory traversal attempts (e.g., sequences like `../` or `..\`) targeting template resolution endpoints.
- **Web Application Firewall (WAF):** Deploy or update WAF rules to detect and block path traversal signatures.
## Conclusion
CVE-2026-87902 represents a significant risk to WordPress environments due to its unauthenticated nature and the potential for full server takeover. Because active exploitation is occurring, it is critical that administrators prioritize patching to version 7.1.2 immediately to prevent site compromise.