An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the
Affects WordPress before 7.1.2 on sites whose active theme has a top-level directory starting with page-, plus specific server settings. The fix is in WordPress 7.1.2.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 7.1.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB
- Exploitation: active
- Automatable: no
- Technical impact: total
Summary
WordPress sites are affected: an unauthenticated attacker can cause the page-template lookup to load a readable PHP file from outside the active theme folders. If the server and active theme meet certain conditions, this could allow remote code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- Public exploit on Exploit-DB
EDB-52690
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- WordPress WordPress
fixed in 7.1.2
References 2
GitHub · WordPress/wordpress-develop
Exploit-DB
Questions about CVE-2026-87902
What does this mean?
WordPress page-template lookup can be made to include a chosen readable local .php file from outside the active theme directories. In the right server setup, this can lead to remote code execution.Source: github.com
Am I affected, and how do I check?
WordPress versions before 7.1.2 are affected when the active child or parent theme has a top-level directory whose name starts with page-, such as page-templates. The server also needs PHP register_argc_argv set to On, and the official PHP Docker image or the default cPanel configuration with PHP before 8.5 match this setup. To check, review the theme's top-level folder names and the register_argc_argv value in the PHP configuration.Source: github.com
What should I do about it?
Update WordPress to version 7.1.2 or later, which contains the fix for this vulnerability.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-25, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).Source: cisa.gov, cve.now feed data