CVE-2026-87902
published 2026-09-22CVE-2026-87902: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…
PriorityP191high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-28
Exploited in the wild
EPSS
39.98%
98.6th percentile
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wordpress | wordpress | < 7.1.2 | 7.1.2 |
| wordpress | wordpress | < 4.7.37 | 4.7.37 |
| wordpress | wordpress | < 7.1.2 | 7.1.2 |
| wordpress | wordpress | >= 4.8 < 4.8.32 | 4.8.32 |
| wordpress | wordpress | >= 4.9 < 4.9.33 | 4.9.33 |
| wordpress | wordpress | >= 5.0 < 5.0.29 | 5.0.29 |
| wordpress | wordpress | >= 5.1 < 5.1.26 | 5.1.26 |
| wordpress | wordpress | >= 5.2 < 5.2.28 | 5.2.28 |
| wordpress | wordpress | >= 5.3 < 5.3.25 | 5.3.25 |
| wordpress | wordpress | >= 5.4 < 5.4.23 | 5.4.23 |
| wordpress | wordpress | >= 5.5 < 5.5.22 | 5.5.22 |
| wordpress | wordpress | >= 5.6 < 5.6.21 | 5.6.21 |
| wordpress | wordpress | >= 5.7 < 5.7.19 | 5.7.19 |
| wordpress | wordpress | >= 5.8 < 5.8.17 | 5.8.17 |
| wordpress | wordpress | >= 5.9 < 5.9.18 | 5.9.18 |
| wordpress | wordpress | >= 6.0 < 6.0.16 | 6.0.16 |
| wordpress | wordpress | >= 6.1 < 6.1.14 | 6.1.14 |
| wordpress | wordpress | >= 6.2 < 6.2.13 | 6.2.13 |
| wordpress | wordpress | >= 6.3 < 6.3.12 | 6.3.12 |
| wordpress | wordpress | >= 6.4 < 6.4.12 | 6.4.12 |
| wordpress | wordpress | >= 6.5 < 6.5.12 | 6.5.12 |
| wordpress | wordpress | >= 6.6 < 6.6.9 | 6.6.9 |
| wordpress | wordpress | >= 6.7 < 6.7.9 | 6.7.9 |
| wordpress | wordpress | >= 6.8 < 6.8.10 | 6.8.10 |
| wordpress | wordpress | >= 6.9 < 6.9.9 | 6.9.9 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.1HIGH
cisa8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
WordPress Core Remote File Inclusion Vulnerability
cisa·2026-09-25·CVSS 8.1
CVE-2026-87902 [HIGH] CWE-98 WordPress Core Remote File Inclusion Vulnerability
Vulnerability: WordPress Core Remote File Inclusion Vulnerability
Affected: WordPress Core
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure a
WordPress
WordPress 7.1.2 Release
vendor_wordpress·2026-09-22·CVSS 8.1
CVE-2026-87902 [HIGH] WordPress 7.1.2 Release
Title: WordPress 7.1.2 Release
This security release features a fix for a critical severity security vulnerability.
Because this is a security release, it is recommended that you update your sites immediately.
You can download WordPress 7.1.2 from WordPress.org , or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.
Security update included in this release
The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server envir
VulDB
WordPress up to 7.1.1 Page Template Resolution get_page_template path traversal
vuldb·2026-09-26·CVSS 8.1
CVE-2026-87902 [HIGH] WordPress up to 7.1.1 Page Template Resolution get_page_template path traversal
A vulnerability, which was classified as critical, has been found in WordPress up to 7.1.1. The affected element is the function get_page_template of the component Page Template Resolution. This manipulation causes path traversal.
This vulnerability is registered as CVE-2026-87902. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
It is advisable to upgrade the affected component.
VulnCheck
WordPress wordpress Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
vulncheck·2026·CVSS 8.1
CVE-2026-87902 [HIGH] WordPress wordpress Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
WordPress wordpress Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Affected: WordPress wordpress
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/wordpress/vulnerability/wordpress-core-7-1-1-unauthenticated-local-file-inclusion-to-remote-code-execution-vulnerability
Exploit PoC: https://vuln
No detection rules found.
Exploit-DB
WordPress 7.0.2 - Path Travesal
exploitdb·2026-10-01·CVSS 8.1
CVE-2026-87902 [HIGH] WordPress 7.0.2 - Path Travesal
WordPress 7.0.2 - Path Travesal
---
# Exploit Title: WordPress 7.0.2 - Path Travesal
# Google Dork: N/A
# Date: 2026-09-22
# Exploit Author: Robert Ressl (https://ressl.ch)
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/download/releases/
# Version: WordPress 7.0.2 (patched in 7.1.2 and 7.0.6; backports to every =
branch down to 4.7.37)
# Tested on: WordPress 7.0.2 / PHP 8.3.33 (Apache module) / MySQL 8.4 (offi=
cial wordpress:7.0.2-php8.3-apache image, x86-64 and arm64)
# CVE: CVE-2026-87902
# Advisory: https://github.com/WordPress/wordpress-develop/security/advisor=
ies/GHSA-7hp8-65ch-5whp
# Write-up: https://ressl.ch/blog/cve-2026-87902-wordpress/
# Source: https://github.com/ressl/cve-2026-87902-poc
#
# Requires: Python 3.6+ (standard library only)
#
Nuclei
WordPress Core - PHP Template Path Traversal
nuclei·CVSS 8.1
CVE-2026-87902 [HIGH] WordPress Core - PHP Template Path Traversal
WordPress Core - PHP Template Path Traversal
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Template:
id: CVE-2026-87902
info:
name: WordPress Core - PHP Template Path Traversal
author: Hadrian,FLX
severity: critical
description: |
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
impact: |
An unauthenticated attacker can include local PHP files outside the act
Bugzilla
CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability [fedora-all]
bugzilla·2026-09-23·CVSS 8.1
CVE-2026-87902 [HIGH] CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability [fedora-all]
CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Discussion:
FEDORA-2026-5c9d8e41a9 (wordpress-6.9.9-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-5c9d8e41a9
---
FEDORA-2026-7f9c6
Bugzilla
CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability [epel-all]
bugzilla·2026-09-23·CVSS 8.1
CVE-2026-87902 [HIGH] CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability [epel-all]
CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Discussion:
FEDORA-EPEL-2026-c032162b28 (wordpress-6.9.9-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c032162b28
---
FEDORA
Checkpoint
28th September – Threat Intelligence Report
blogs_checkpoint·2026-09-28
CVE-2026-85102 28th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 21
Android Malware 23
Artificial Intelligence 5
ChatGPT 3
Check Point Research Publications 474
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 426
How To Guides 13
Ransomware 6
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 175
Web 3.0 Security 11
Wipers 0
## 28th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
The FBI
Hackernews
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
blogs_hackernews·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.
Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.
Here’s the full recap of what mattered this week.
## ⚡ Threat of the Week
Citrix
Hackernews
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
blogs_hackernews·2026-09-24·CVSS 8.1
CVE-2026-87902 [HIGH] Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.
The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).
"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories," WordPress said in an advisory released two days ago. "If relevant preconditions for both the server environment and the active
Hackernews
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
blogs_hackernews·2026-09-22·CVSS 8.1
CVE-2026-87902 [HIGH] WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders.
On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.1.2, with fixes for every branch the project still supports, back to 4.7, and WordPress is telling site owners to update now .
WordPress rates the flaw as critical, assigns it a CVSS score of 9.2, and assigns it CVE-2026-87902 . Reaching it requires no accou
2026-09-22
Published
2026-09-25
Added to CISA KEV
Exploited in the wild