CVE-2026-87902High· 8.1▾ Abyssal⚠ Exploited in the wildPoC availableAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 44.6 · likelihood 19.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit-DB · 25 GitHub repos · Nuclei ×1
0.4%
Federal remediation due Sep 28, 2026
Last analysed / modified upstream
0.4% → 96%
Added to the CISA catalog on Sep 25, 2026. Federal remediation due Sep 28, 2026. View catalog ↗
An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
wordpress < 4.7.37wordpress >= 4.8, < 4.8.32wordpress >= 4.9, < 4.9.33wordpress >= 5.0, < 5.0.29wordpress >= 5.1, < 5.1.26wordpress >= 5.2, < 5.2.28wordpress >= 5.3, < 5.3.25wordpress >= 5.4, < 5.4.23wordpress >= 5.5, < 5.5.22wordpress >= 5.6, < 5.6.21wordpress >= 5.7, < 5.7.19wordpress >= 5.8, < 5.8.17wordpress >= 5.9, < 5.9.18wordpress >= 6.0, < 6.0.16wordpress >= 6.1, < 6.1.14wordpress >= 6.2, < 6.2.13wordpress >= 6.3, < 6.3.12wordpress >= 6.4, < 6.4.12wordpress >= 6.5, < 6.5.12wordpress >= 6.6, < 6.6.9wordpress >= 6.7, < 6.7.9wordpress >= 6.8, < 6.8.10wordpress >= 6.9, < 6.9.9wordpress >= 7.0, < 7.0.6wordpress >= 7.1, < 7.1.2Upgrade past the affected range:
wordpress 7.1.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63030Critical· 9.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL In…
CVE-2026-60137Medium· 5.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVE-2026-93485High· 7.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 throug…
CVE-2026-114570Medium· 4.9WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
CVE-2026-66666Medium· 6.9Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from …
CVE-2023-39999Medium· 4.3Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9…