A recently disclosed vulnerability (CVE-2026-87902) affects WordPress Core and may allow an unauthenticated remote attacker to achieve remote code execution (RCE) on vulnerable WordPress sites when specific theme and server conditions are present.
Severity level:
CVSS Score: 9.2/Critical.
Description:
CVE-2026-87902 is a critical path traversal vulnerability in WordPress Core's get_page_template() functionality. The flaw allows an unauthenticated attacker to manipulate page template resolution and cause WordPress to include a readable local PHP file located outside the active theme directory. Under specific conditions, including the presence of a theme directory beginning with page- and a suitable PHP file accessible to the web server, an attacker may leverage the vulnerability to execute arbitrary code and fully compromise the affected website.
Affected Versions:
- WordPress core version prior to 7.1.2
- Older WordPress branches 4.7.x through 7.1.x prior to their respective security updates.
Impact:
Successful exploitation may allow attackers to gain unauthorized access to the WordPress environment.
Resolution:
Upgrade WordPress immediately to a patched version appropriate to the branch:-
- WordPress 7.1.2 or later.
- WordPress security releases for 7.0.x, 6.9.x, 6.8.x and older supported branches.
Reference:
UIT Information Security