A critical, unpatched vulnerability in WordPress has exposed millions of websites to a straightforward takeover attack for nearly a decade. The flaw, designated CVE-2026-87902, carries a CVSS score of 9.2 and allows remote code execution without any user credentials.
The vulnerability lies in the core way WordPress resolves page templates—a function present since version 4.7. Security researchers report it is an unauthenticated local file inclusion bug, meaning attackers require no login or prior access to exploit it.
The direct path to full control is the key danger. This file inclusion flaw can be escalated to execute arbitrary code on the server, granting an attacker complete control of the website. Given WordPress's vast market share, the potential impact spans millions of sites.
The official fix was released in WordPress version 7.1.2 on September 22. The update patches the template parsing functions at the root of the issue. All WordPress installations running version 4.7 through 7.1.1 are vulnerable and must update to 7.1.2 immediately.
While temporary workarounds exist, such as disabling certain template functions, they are insufficient for long-term security. The severe nature of this flaw and its lack of authentication requirements make applying the official patch the only reliable mitigation.
This incident highlights the severe risk posed by long-dormant flaws in core software components. Site administrators and IT teams are urged to verify their WordPress version and apply the update without delay to secure their systems.
WordPress 中一個未經修補的關鍵漏洞，近十年來令數以百萬計的網站暴露於一種簡單的接管攻擊之下。該漏洞被編號為 CVE-2026-87902，CVSS 評分為 9.2 分，允許攻擊者在無需任何用戶憑證的情況下執行遠端代碼。
漏洞存在於 WordPress 解析頁面範本的核心方式中——此功能自 4.7 版本起即已存在。安全研究人員指出，這是一個未經授權的本地文件包含漏洞，這意味著攻擊者無需登入或事先取得權限即可利用它。
直接的完全控制路徑是主要的危險所在。這個文件包含漏洞可被升級，以在伺服器上執行任意代碼，從而賦予攻擊者對網站的完全控制權。鑑於 WordPress 巨大的市場佔有率，其潛在影響遍及數以百萬計的網站。
官方修補程式已於 9 月 22 日在 WordPress 7.1.2 版本中發布。此次更新修補了問題根源的範本解析功能。所有運行 4.7 至 7.1.1 版本的 WordPress 安裝均受漏洞影響，必須立即升級至 7.1.2 版本。
雖然存在臨時解決方案，例如禁用某些範本功能，但這對於長期安全而言並不足夠。此漏洞的嚴重性質及其無需認證的特性，使得應用官方修補程式成為唯一可靠的緩解措施。
此次事件突顯了核心軟件組件中長期潛伏漏洞所帶來的嚴重風險。網站管理員和 IT 團隊應盡快核實其 WordPress 版本並應用更新，以確保系統安全。