CVE-2026-87902: listed in the CISA KEV catalog CVE-2026-87902 · CVSS 8.1 HIGH · KEV 2026-09-25 · patch available
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Is CVE-2026-87902 exploited? Listed in the CISA KEV catalog on 2026-09-25. Federal remediation due 2026-09-28. Past that date by 46 days. Public exploit code: proof of concept. Public detection rules exist. Which products and versions are affected? WordPress · WordPress · >= 0, < 7.1.2 Is there a patch? Yes. Update to one of these or later:
From WordPress's CVE record · WordPress advisory
What PlainSec published about CVE-2026-87902 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-10-18.
CVE-2026-87902: listed in the CISA KEV catalog CVE-2026-87902 · CVSS 8.1 HIGH · KEV 2026-09-25 · patch available
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Is CVE-2026-87902 exploited? Listed in the CISA KEV catalog on 2026-09-25. Federal remediation due 2026-09-28. Past that date by 46 days. Public exploit code: proof of concept. Public detection rules exist. Which products and versions are affected? WordPress · WordPress · >= 0, < 7.1.2 Is there a patch? Yes. Update to one of these or later:
From WordPress's CVE record · WordPress advisory
What PlainSec published about CVE-2026-87902 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-10-18.