{"id":"CVE-2026-87902","title":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories","summary":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-98"],"vendor":"wordpress","product":"wordpress","affected":["wordpress < 4.7.37","wordpress >= 4.8, < 4.8.32","wordpress >= 4.9, < 4.9.33","wordpress >= 5.0, < 5.0.29","wordpress >= 5.1, < 5.1.26","wordpress >= 5.2, < 5.2.28","wordpress >= 5.3, < 5.3.25","wordpress >= 5.4, < 5.4.23","wordpress >= 5.5, < 5.5.22","wordpress >= 5.6, < 5.6.21","wordpress >= 5.7, < 5.7.19","wordpress >= 5.8, < 5.8.17","wordpress >= 5.9, < 5.9.18","wordpress >= 6.0, < 6.0.16","wordpress >= 6.1, < 6.1.14","wordpress >= 6.2, < 6.2.13","wordpress >= 6.3, < 6.3.12","wordpress >= 6.4, < 6.4.12","wordpress >= 6.5, < 6.5.12","wordpress >= 6.6, < 6.6.9","wordpress >= 6.7, < 6.7.9","wordpress >= 6.8, < 6.8.10","wordpress >= 6.9, < 6.9.9","wordpress >= 7.0, < 7.0.6","wordpress >= 7.1, < 7.1.2"],"patched":["wordpress 7.1.2"],"published":"2026-09-22","updated":"2026-09-28","sourceUpdated":"2026-09-28T12:20:54.040","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902","references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","label":"support@hackerone.com"},{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87902.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87902"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87902"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org","csaf","vex","red-hat"],"epss":0.95769,"epssPercentile":0.99871,"kev":true,"kevDateAdded":"2026-09-25","kevDueDate":"2026-09-28","kevRansomware":false,"exploited":true,"exploits":{"exploitdb":true,"github":25,"githubRepos":["https://github.com/ressl/cve-2026-87902-poc","https://github.com/abraxas/CVE-2026-87902","https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab"],"nuclei":["CVE-2026-87902"],"checkedAt":"2026-10-27T19:20:01.129Z"},"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-09-25T19:40:04.026420Z"},"ingestedAt":"2026-09-22T17:07:07.379Z","slug":"CVE-2026-87902","body":"## Overview\n\nAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.\n\n## Affected\n\n- `wordpress < 4.7.37`\n- `wordpress >= 4.8, < 4.8.32`\n- `wordpress >= 4.9, < 4.9.33`\n- `wordpress >= 5.0, < 5.0.29`\n- `wordpress >= 5.1, < 5.1.26`\n- `wordpress >= 5.2, < 5.2.28`\n- `wordpress >= 5.3, < 5.3.25`\n- `wordpress >= 5.4, < 5.4.23`\n- `wordpress >= 5.5, < 5.5.22`\n- `wordpress >= 5.6, < 5.6.21`\n- `wordpress >= 5.7, < 5.7.19`\n- `wordpress >= 5.8, < 5.8.17`\n- `wordpress >= 5.9, < 5.9.18`\n- `wordpress >= 6.0, < 6.0.16`\n- `wordpress >= 6.1, < 6.1.14`\n- `wordpress >= 6.2, < 6.2.13`\n- `wordpress >= 6.3, < 6.3.12`\n- `wordpress >= 6.4, < 6.4.12`\n- `wordpress >= 6.5, < 6.5.12`\n- `wordpress >= 6.6, < 6.6.9`\n- `wordpress >= 6.7, < 6.7.9`\n- `wordpress >= 6.8, < 6.8.10`\n- `wordpress >= 6.9, < 6.9.9`\n- `wordpress >= 7.0, < 7.0.6`\n- `wordpress >= 7.1, < 7.1.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wordpress 7.1.2`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87902.json)","depth":"abyssal","depthScore":89,"depthScoreParts":{"impact":44.6,"likelihood":19.2,"exploitation":25,"ransomware":0},"changes":[{"seq":230241,"id":"CVE-2026-87902","ts":1793128801732,"field":"epss","old":"0.39979","new":"0.95769"},{"seq":219394,"id":"CVE-2026-87902","ts":1791813771732,"field":"epss","old":"0.46117","new":"0.39979"},{"seq":215049,"id":"CVE-2026-87902","ts":1790977346472,"field":"epss","old":"0.19756","new":"0.45501"},{"seq":211601,"id":"CVE-2026-87902","ts":1790510259739,"field":"epss","old":"0.02877","new":"0.18166"},{"seq":211162,"id":"CVE-2026-87902","ts":1790367506893,"field":"exploited","old":"false","new":"true"},{"seq":211161,"id":"CVE-2026-87902","ts":1790367506893,"field":"kev","old":"false","new":"true"},{"seq":209516,"id":"CVE-2026-87902","ts":1790149748479,"field":"exploit_available","old":"false","new":"true"}]}