CVE-2026-87902

Summary

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Affected Software

VendorProductVersion RangeStatus
WordPressWordPress0 < 7.1.2affected

Weaknesses

  • CWE-98: CWE-98 Remote File Inclusion

Workarounds

WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References