# The theme file was the door

2026-09-28

WordPress patched CVE-2026-87902 on 22 September. Probes started the same day. CISA’s federal due date is today. The bug is a local file include with preconditions, not a magic URL for every blog.

Canonical: https://www.fabiocti.com/notes/the-theme-file-was-the-door/
Author: Fabio Correia

The patch and the traffic landed on the same afternoon. The federal due date is today.

WordPress shipped fixes on 22 September for CVE-2026-87902, in 7.1.2, 7.0.6, 6.9.9, and 6.8.10, covering the 4.7 through 7.1.1 lines that are still in support. CISA added it to the KEV list on 25 September as a core remote file inclusion and set 28 September as the date for civilian federal agencies. Patchstack recorded a first attempt at 11:49 UTC on the 22nd, hours after the release, and described later traffic as far above that first hour. The Hacker News counted dozens of attempts. A public proof-of-concept exists. Known ransomware use is still marked unknown.

The project’s own description is narrower than the headline. Unauthenticated page-template handling can include a readable local PHP file from outside the active theme directories, when the theme and server conditions in the advisory are met, and that can become code execution. If those conditions are not met, you do not have this bug just because the version string is old. If they are met, “it’s only a read” is how you talk yourself out of looking.

## What a version check will miss

The scanner wants 7.1.2 or the matching older branch. The incident wants to know whether anyone asked the template loader to open a file that was never a theme, on or after 22 September. Patching this morning does not answer that. CISA’s order for federal systems is the patch plus a look at whether it was already used. The rest of the internet does not get the order. It gets the same probes.

Plugins are the usual WordPress story. This one is core. Waiting on a plugin vendor is the wrong queue.

## If the site is yours, or your client’s brochure

Match the branch, not “latest” as a vibe. Then look for template requests that resolved outside the theme, and for PHP that appeared where a theme file should not be. Preconditions are a reason to verify scope. They are not a reason to leave 7.1.1 up because the marketing site “doesn’t do anything.”

The due date on the KEV line is today. The probes did not wait for it.