WordPress core

CVE-2026-87902

Unauthenticated path traversal in page-template resolution leading to conditional RCE

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Sept 2026.

Severity: High 8.1
Published: 22 Sept 2026
Last changed: 28 Sept 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2
Also known as: GHSA-7hp8-65ch-5whp
Sources: NVD, WordPress

Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Affected software

Software Affected versions

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	From 7.1 before 7.1.2 From 7.0 before 7.0.6 From 6.9 before 6.9.9 From 6.8 before 6.8.10 All 26 release lines Every version before 4.7.37 From 4.7.0 before 4.7.37 From 4.8 before 4.8.32 From 4.9 before 4.9.33 From 5.0 before 5.0.29 From 5.1 before 5.1.26 From 5.2 before 5.2.28 From 5.3 before 5.3.25 From 5.4 before 5.4.23 From 5.5 before 5.5.22 From 5.6 before 5.6.21 From 5.7 before 5.7.19 From 5.8 before 5.8.17 From 5.9 before 5.9.18 From 6.0 before 6.0.16 From 6.1 before 6.1.14 From 6.2 before 6.2.13 From 6.3 before 6.3.12 From 6.4 before 6.4.12 From 6.5 before 6.5.12 From 6.6 before 6.6.9 From 6.7 before 6.7.9 From 6.8 before 6.8.10 From 6.9 before 6.9.9 From 7.0 before 7.0.6 From 7.1 before 7.1.2

WordPressWordPress core · cpe:a:wordpress:wordpress

From 7.1 before 7.1.2
From 7.0 before 7.0.6
From 6.9 before 6.9.9
From 6.8 before 6.8.10

All 26 release lines

Every version before 4.7.37
From 4.7.0 before 4.7.37
From 4.8 before 4.8.32
From 4.9 before 4.9.33
From 5.0 before 5.0.29
From 5.1 before 5.1.26
From 5.2 before 5.2.28
From 5.3 before 5.3.25
From 5.4 before 5.4.23
From 5.5 before 5.5.22
From 5.6 before 5.6.21
From 5.7 before 5.7.19
From 5.8 before 5.8.17
From 5.9 before 5.9.18
From 6.0 before 6.0.16
From 6.1 before 6.1.14
From 6.2 before 6.2.13
From 6.3 before 6.3.12
From 6.4 before 6.4.12
From 6.5 before 6.5.12
From 6.6 before 6.6.9
From 6.7 before 6.7.9
From 6.8 before 6.8.10
From 6.9 before 6.9.9
From 7.0 before 7.0.6
From 7.1 before 7.1.2

Known exploited

CISA name: WordPress Core Remote File Inclusion Vulnerability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies: 28 Sept 2026
Used in ransomware: Not known

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2026-87902
CVE.org https://www.cve.org/CVERecord?id=CVE-2026-87902
GitHub Advisory Database https://github.com/advisories/GHSA-7hp8-65ch-5whp
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp