New WordPress vulnerability - CVE-2026-87902

Here's what my data centre emailed me. I only host a handful of WP sites but have updated.

We are writing to advise you of a critical security vulnerability that has been disclosed in WordPress Core and addressed in the latest security release. CVE-2026-87902 – An unauthenticated path traversal issue in page-template resolution leading to conditional remote code execution.

Due to the severity of this vulnerability, we strongly recommend updating your WordPress installation immediately.

These WP versions are reported as safe:
WordPress 7.1.2
WordPress 7.0.6
WordPress 6.9.9
WordPress 6.8.10
WordPress 6.7.9
WordPress 6.6.9
WordPress 6.5.12
WordPress 6.4.12
WordPress 6.3.12
WordPress 6.2.13
WordPress 6.1.14
WordPress 6.0.16
WordPress 5.9.18
WordPress 5.8.17
WordPress 5.7.19
WordPress 5.6.21
WordPress 5.5.22
WordPress 5.4.23
WordPress 5.3.25
WordPress 5.2.28
WordPress 5.1.26
WordPress 5.0.29
WordPress 4.9.33
WordPress 4.8.32
WordPress 4.7.37

I also added some new custom ModSec rules and have shared them below

Code: [Select]

# --------------------------------------------------------------------
# Virtual patch for unauthenticated traversal attempts
# --------------------------------------------------------------------

SecRule REQUEST_URI "@rx (?i)(?:%2e%2e|%252e%252e)" \
    "id:10024,\
    phase:1,\
    t:none,\
    deny,\
    status:403,\
    log,\
    msg:'CVE-2026-87902 - WordPress encoded path traversal attempt',\
    tag:'CVE-2026-87902',\
    tag:'WordPress',\
    tag:'path-traversal',\
    severity:CRITICAL"

# --------------------------------------------------------------------
# CVE-2026-87902 - encoded traversal in request parameters
# --------------------------------------------------------------------

SecRule ARGS "@rx (?i)(?:\.\./|%2e%2e(?:/|%2f)|%252e%252e(?:/|%252f))" \
    "id:10025,\
    phase:2,\
    t:none,\
    deny,\
    status:403,\
    log,\
    msg:'CVE-2026-87902 - WordPress path traversal attempt',\
    tag:'CVE-2026-87902',\
    tag:'WordPress',\
    tag:'path-traversal',\
    severity:CRITICAL"

Thank You