---
id: CVE-2026-87902
title: >-
  An unauthenticated attacker can make `get_page_template()` page-template
  resolution include a chosen readable local `.php` file outside the active
  theme directories
summary: >-
  An unauthenticated attacker can make `get_page_template()` page-template
  resolution include a chosen readable local `.php` file outside the active
  theme directories. If relevant pre-conditions for both the server and the
  active theme are…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-98
vendor: wordpress
product: wordpress
affected:
  - wordpress < 4.7.37
  - 'wordpress >= 4.8, < 4.8.32'
  - 'wordpress >= 4.9, < 4.9.33'
  - 'wordpress >= 5.0, < 5.0.29'
  - 'wordpress >= 5.1, < 5.1.26'
  - 'wordpress >= 5.2, < 5.2.28'
  - 'wordpress >= 5.3, < 5.3.25'
  - 'wordpress >= 5.4, < 5.4.23'
  - 'wordpress >= 5.5, < 5.5.22'
  - 'wordpress >= 5.6, < 5.6.21'
  - 'wordpress >= 5.7, < 5.7.19'
  - 'wordpress >= 5.8, < 5.8.17'
  - 'wordpress >= 5.9, < 5.9.18'
  - 'wordpress >= 6.0, < 6.0.16'
  - 'wordpress >= 6.1, < 6.1.14'
  - 'wordpress >= 6.2, < 6.2.13'
  - 'wordpress >= 6.3, < 6.3.12'
  - 'wordpress >= 6.4, < 6.4.12'
  - 'wordpress >= 6.5, < 6.5.12'
  - 'wordpress >= 6.6, < 6.6.9'
  - 'wordpress >= 6.7, < 6.7.9'
  - 'wordpress >= 6.8, < 6.8.10'
  - 'wordpress >= 6.9, < 6.9.9'
  - 'wordpress >= 7.0, < 7.0.6'
  - 'wordpress >= 7.1, < 7.1.2'
patched:
  - wordpress 7.1.2
published: '2026-09-22'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T12:20:54.040'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87902'
references:
  - url: >-
      https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
    label: support@hackerone.com
  - url: >-
      https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87902.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-87902'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-87902'
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.95769
epssPercentile: 0.99871
kev: true
kevDateAdded: '2026-09-25'
kevDueDate: '2026-09-28'
kevRansomware: false
exploited: true
exploits:
  exploitdb: true
  github: 25
  githubRepos:
    - 'https://github.com/ressl/cve-2026-87902-poc'
    - 'https://github.com/abraxas/CVE-2026-87902'
    - 'https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab'
  nuclei:
    - CVE-2026-87902
  checkedAt: '2026-10-27T19:20:01.129Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-25T19:40:04.026420Z'
ingestedAt: '2026-09-22T17:07:07.379Z'
---

## Overview

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

## Affected

- `wordpress < 4.7.37`
- `wordpress >= 4.8, < 4.8.32`
- `wordpress >= 4.9, < 4.9.33`
- `wordpress >= 5.0, < 5.0.29`
- `wordpress >= 5.1, < 5.1.26`
- `wordpress >= 5.2, < 5.2.28`
- `wordpress >= 5.3, < 5.3.25`
- `wordpress >= 5.4, < 5.4.23`
- `wordpress >= 5.5, < 5.5.22`
- `wordpress >= 5.6, < 5.6.21`
- `wordpress >= 5.7, < 5.7.19`
- `wordpress >= 5.8, < 5.8.17`
- `wordpress >= 5.9, < 5.9.18`
- `wordpress >= 6.0, < 6.0.16`
- `wordpress >= 6.1, < 6.1.14`
- `wordpress >= 6.2, < 6.2.13`
- `wordpress >= 6.3, < 6.3.12`
- `wordpress >= 6.4, < 6.4.12`
- `wordpress >= 6.5, < 6.5.12`
- `wordpress >= 6.6, < 6.6.9`
- `wordpress >= 6.7, < 6.7.9`
- `wordpress >= 6.8, < 6.8.10`
- `wordpress >= 6.9, < 6.9.9`
- `wordpress >= 7.0, < 7.0.6`
- `wordpress >= 7.1, < 7.1.2`

## Remediation

Upgrade past the affected range:

- `wordpress 7.1.2`

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87902.json)