WordPress 7.1.2 Patches a Critical Path Traversal to RCE: Update Now

CVE-2026-87902 lets an unauthenticated request include a local PHP file through page template resolution. It is on CISA's exploited list, and the fix is WordPress 7.1.2 or the backport for your branch.