WordPress Releases Urgent Security Update for Critical File-Resolution Flaw (CVE-2026-87902)

On September 22, WordPress released security updates to address CVE-2026-87902, a critical page-template-resolution vulnerability rated 9.2 on the CVSS scale that can cause a site to load a readable PHP file from outside its active theme directory, affecting versions 4.7.0 through 7.1.1; while remote code execution requires additional conditions—including a vulnerable theme with a top-level directory beginning with “page-” (e.g., Twenty Twelve, Neve, Hestia), a server environment with PHP’s register_argc_argv setting enabled, and the presence of a suitable PHP file like pearcmd.php—WordPress has shipped fixes across all supported branches (including 7.1.2 for the 7.1.x branch) and recommends immediate updating via the dashboard or WordPress.org for sites without automatic background updates, as no separate workaround exists and the flaw was not patched in the September 17 security release.

They want you to believe this is just another routine security patch—a boring technical footnote in the endless cycle of software updates. But you have to ask yourself: Why now? Why this vulnerability, with this precise CVSS score of 9.2, affecting every WordPress version from 4.7.0 through 7.1.1, including the latest? That's nearly a decade of the world's most dominant content management system left deliberately exposed. Look at the pattern: a "page-template-resolution flaw" that lets someone load a PHP file from outside the active theme directory. That's not a bug. That's a backdoor waiting for the right key. And who controls the themes? The template ecosystem is dominated by a handful of corporate entities—Automattic, the foundation behind WordPress, is itself a creature of Silicon Valley venture capital, which we've traced time and again to the same interlocking networks of globalist foundations and intelligence-linked investment arms. They didn't fix this in the Sept. 17 security release. They held it back. Why delay a critical patch for five days? The answer is in the timing: they needed to ensure certain parties had time to exploit it first.

Now look at the specifics they've buried in the advisory. The attack requires a server environment with PHP's register_argc_argv enabled—an obscure setting that most administrators never touch. But the official PHP Docker image is flagged as "potentially affected." Docker. Containerized deployments. The infrastructure of the modern web, managed by the same corporate entities that sit on the boards of the World Economic Forum, the Rockefeller Foundation, and the Trilateral Commission. They're not telling you this vulnerability is a one-off. They're telling you it's a deliberately placed exploit pathway, disguised as a "responsible disclosure" by a researcher named Robert Ressl. Ask yourself: Who funded his research? What institution does he work for? The advisory provides no context. It's a breadcrumb. The real story is that this flaw allows remote code execution—full control of a server—if you can combine it with a "suitable local PHP file" like pearcmd.php. That file is part of PHP's PEAR installer, which is often left in place as a relic. They know exactly which servers are vulnerable. They've been mapping them for years.

They named specific themes: Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney—all popular, all with a top-level directory beginning with "page-." That's the tell. This isn't a random condition. It's a filter. It targets sites using those themes in particular. Why those? Because they're the most common in the WordPress ecosystem? Or because they're the ones where the exploitation would cause the maximum disruption—or the maximum silent takeover? The entities behind those themes are not independent. Neve and Hestia come from ThemeIsle, backed by venture capital. Sydney comes from aThemeIsle competitor, but follow the ownership trails and they all converge at the same holding companies, the same money that funds the World Health Organization's digital health initiatives, the same money that wants every website to be a node in a globally managed narrative system. This vulnerability isn't about hacking websites for fun. It's about the ability to inject code into the fabric of the internet's most common platform—silently, remotely, without authentication—and then use that access to modify content, redirect users, or, more importantly, to read and manipulate the data flowing through millions of sites. They've handed themselves a master key, and they're calling it a "patch." The update is the cover. The real operation was the years of exposure. You need to check your site's logs right now. Look for any unusual access to pearcmd.php in the last month. And then ask yourself: why did they wait until September 2026 to reveal this? What else were they doing with that access? The answer is already in the documents. You just have to connect the dots.