CVE-2026-87902
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whpVendor Advisory
- patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902US Government Resource
- CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Base
CISA Alerts · 31d ago
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 28 days
- CVSS
- 8.1 HIGH
- EPSS (30-day exploit probability)
- 95.8% · top 1% of all CVEs
- Weakness
- CWE-98
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.