CVEvulnerability

CVE-2026-87902

8.1 HIGH Known exploited Published 2026-09-22 Modified 2026-09-28 Official page ↗

CISA Known Exploited Vulnerability

WordPress Core Remote File Inclusion Vulnerability — WordPress Core

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

Added to KEV: 2026-09-25
Remediation due: 2026-09-28
Ransomware use: Unknown
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902

Status: Analyzed
Published: 2026-09-22
Last modified: 2026-09-28
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-98

Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Affected configurations

• wordpress wordpress (< 4.7.37) • wordpress wordpress (>= 4.8 < 4.8.32) • wordpress wordpress (>= 4.9 < 4.9.33) • wordpress wordpress (>= 5.0 < 5.0.29) • wordpress wordpress (>= 5.1 < 5.1.26) • wordpress wordpress (>= 5.2 < 5.2.28) • wordpress wordpress (>= 5.3 < 5.3.25) • wordpress wordpress (>= 5.4 < 5.4.23) • wordpress wordpress (>= 5.5 < 5.5.22) • wordpress wordpress (>= 5.6 < 5.6.21) • wordpress wordpress (>= 5.7 < 5.7.19) • wordpress wordpress (>= 5.8 < 5.8.17) • wordpress wordpress (>= 5.9 < 5.9.18) • wordpress wordpress (>= 6.0 < 6.0.16) • wordpress wordpress (>= 6.1 < 6.1.14) • wordpress wordpress (>= 6.2 < 6.2.13) • wordpress wordpress (>= 6.3 < 6.3.12) • wordpress wordpress (>= 6.4 < 6.4.12) • wordpress wordpress (>= 6.5 < 6.5.12) • wordpress wordpress (>= 6.6 < 6.6.9) • wordpress wordpress (>= 6.7 < 6.7.9) • wordpress wordpress (>= 6.8 < 6.8.10) • wordpress wordpress (>= 6.9 < 6.9.9) • wordpress wordpress (>= 7.0 < 7.0.6) • wordpress wordpress (>= 7.1 < 7.1.2)

Weakness · CWE (1)

CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program weakness

References