Your message dated Wed, 23 Sep 2026 10:34:13 +0000
with message-id <[email protected]>
and subject line Bug#1148743: fixed in wordpress 7.1.2+dfsg1-1
has caused the Debian Bug report #1148743,
regarding wordpress: CVE-2026-87902 Unauthenticated path traversal leading to
conditional RCE
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148743: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148743
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: wordpress
Version: 7.1.1+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
An unauthenticated attacker can make get_page_template() page-template
resolution include a chosen readable local .php file outside the active
theme directories. If relevant pre-conditions for both the server
environment and the active theme are met, this can lead to RCE.
7.1.2 and 6.8.10 have fixes for sid and trixie respectively.
Refs:
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable-debug'), (500, 'stable'), (50, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.12.105+deb13-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8),
LANGUAGE=en_AU:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages wordpress depends on:
ii apache2 [httpd] 2.4.68-1~deb13u1
ii ca-certificates 20250419
pn default-mysql-client | virtual-mysql-c <none>
lient
pn libapache2-mod-php | php <none>
pn libjs-cropper <none>
ii libjs-jquery-ui 1.13.2+dfsg-1
ii libjs-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9
ii libjs-underscore 1.13.4~dfsg+~1.11.4-3
ii libphp-phpmailer 7.1.1-1
pn php-gd <none>
pn php-getid3 <none>
pn php-mysql | php-mysqlnd <none>
Versions of packages wordpress recommends:
pn wordpress-l10n <none>
pn wordpress-theme-twentytwentyfive <none>
Versions of packages wordpress suggests:
pn default-mysql-server | virtual-mysql-server <none>
pn php-curl <none>
pn php-imagick <none>
pn php-mbstring <none>
pn php-ssh2 <none>
ii php-xml 2:8.4+96
pn php-zip <none>
ii php8.4-xml [php-xml] 8.4.24-1~deb13u1
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 7.1.2+dfsg1-1
Done: Craig Small <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 23 Sep 2026 20:13:17 +1000
Source: wordpress
Architecture: source
Version: 7.1.2+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Closes: 1148743
Changes:
wordpress (7.1.2+dfsg1-1) unstable; urgency=high
.
* new upstream security release
Fixes CVE-2026-87902 Conditional RCE in theme path traversal
Closes: #1148743
Checksums-Sha1:
2a69d574fd50f4ef8ac065533a5a81fecba9d812 2359 wordpress_7.1.2+dfsg1-1.dsc
083d27fcb2fc516e15d8dd1e53100fef63083b38 28033704
wordpress_7.1.2+dfsg1.orig.tar.xz
dd51b5d3d1f9f6def227fcdb169ca625bd920ec4 1603668
wordpress_7.1.2+dfsg1-1.debian.tar.xz
96c52195b8bc4f44a9e6413c63841c00344caf89 7229
wordpress_7.1.2+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
32ce143b9b693606bff1f4bf7f8b54f175b38ae677ca3534770df368770c300b 2359
wordpress_7.1.2+dfsg1-1.dsc
fb3e9f04807bb0b9e123fbf73555c6378fb715aac279359b4b2f3b7a04dfc1db 28033704
wordpress_7.1.2+dfsg1.orig.tar.xz
dc556c4e3139b964f0eaed4734ef50300bce06178028b99fc2a58ab37822a35b 1603668
wordpress_7.1.2+dfsg1-1.debian.tar.xz
73b55ac5727ca21eb83e923c55d88cb596153d73280501d6428847a889bc4cf1 7229
wordpress_7.1.2+dfsg1-1_amd64.buildinfo
Files:
6b93e284b1fbbdcb8f141a746f25c25e 2359 web optional wordpress_7.1.2+dfsg1-1.dsc
30d1cb5b0fb84e7e066fc0db88b87e5b 28033704 web optional
wordpress_7.1.2+dfsg1.orig.tar.xz
573db4e72262eecebdb9a199cf8b5e8e 1603668 web optional
wordpress_7.1.2+dfsg1-1.debian.tar.xz
ae3df408b7026ef661dc01b767a62243 7229 web optional
wordpress_7.1.2+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmqzpyQACgkQAiFmwP88
hOP+7g/8Cb2bQJpT6yiOmUTpgI50HoIYBZAK7cgOY+2mekCrPLMkUXuzW6dibB90
qBYKXQvdCWeULNhGQDnXbG/uCuT0CkV8Hmd6SMHMJ6UIAwHYvnO1f/5XY82Y6TFu
H9LsmuExiCzR2eqwfLlYhmRTiYOsebGE400B/HQSo9hIpLs45YdlZNGrzYztexER
dyG9pXXTnbTSM2N9m81zGkAC4P11CwH5WO/+kbdsgQovtqsgbWYrAv8P+cUlYVjC
Wos54CFen7lLZ6+L8T/QkhbuEMJGcBC0HYO+lWcaU7HxHmw+77K/J3KGoeCD+O/P
LYYooKZNXWB333S0hSyl4WgmehwJMy3P3K7I2RtdoITsK1/vQ82ygMGFMShltynS
n+BH32rhSIDVA7Z27Ae4LuQxBhSJAdvS9Qw3npIFMoSv5950eaL5v7qZmDNyctJY
GJryDNXVR05kkaPUQXLwauI+4CTCqAfoofKzWqZ3IWvzqwl0XQ3hWylc82dPkdDo
RMI3K4MnrrVeSkoQjuuDTp8GgEgWYp1o9CwVWd7M3Tirm0PaIHVdphzgIWlC0sAg
vV8NRlTYBVr07BKO+XLeDGNNYw+cVmro4sv45kQDzYMbQdxQbyh6Fqqj8GHy4kyS
sju5uTDQBg68uRduUqewlnRPXpzh5yL5qMTpMZPhkKcJiuXVWbM=
=BTUF
-----END PGP SIGNATURE-----
pgpJCd9qi1BN_.pgp
Description: PGP signature
--- End Message ---
