Description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- WordPress / WordPress0 – 7.1.2
- WordPress / WordPress4.7.37
Exploits & proofs of concept
- exploit-dbWordPress 7.0.2 - Path Travesalby Robert Ressl
- nucleiWordPress Core - PHP Template Path Traversalby Hadrian,FLX
News coverage
- Attackers Exploit WordPress CVE-2026-87902 Within Hours of DisclosureThe Hacker News · 9/24/2026
- Hackers start exploiting critical WordPress flaw for code executionBleepingComputer · 9/23/2026
References
Updated 25m ago · 8 sources