WordPress Core is the open-source PHP and MariaDB content-management system behind everything from personal blogs and small-business sites to stores, publishers, universities, government portals and enterprise web properties. It is self-hosted by site owners, agencies and hosting providers; themes determine how a site looks, while plugins add functions.
CVE-2026-87902 is an unauthenticated path-traversal flaw in the core function get_page_template(). In plain terms, an attacker can manipulate page-template resolution so WordPress tries to include a readable local .php file outside the active theme’s directories. Despite CISA’s “remote file inclusion” label, this is not an attacker hosting a file elsewhere and having WordPress fetch it: the target is a PHP file already present on the vulnerable server.
Inclusion becomes code execution only in particular setups
The inclusion is serious because PHP executes when included. But code execution is conditional, not automatic on every vulnerable site. The active parent or child theme must have a top-level directory beginning page-, such as page-templates; WordPress names Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as examples. The server must also expose a suitable readable PHP file to its web-server account. The vendor advisory identifies pearcmd.php with register_argc_argv enabled as one route that can be turned into code execution.
No login, administrator role or prior foothold is required to reach the vulnerable template-resolution path. If the theme and server preconditions line up, an external attacker can move from a crafted web request to executing commands in the context of the web service, potentially taking control of the site and its accessible data. Robert Ressl is credited with responsibly reporting the issue.
The correction is telling: WordPress now requires the decoded page name to pass validate_file() before adding it as a template candidate.
- if ( $pagename_decoded !== $pagename ) {
+ if ( $pagename_decoded !== $pagename && 0 === validate_file( $pagename_decoded ) ) {
$templates[] = "page-{$pagename_decoded}.php";
}The broader patch also constrains resolved template paths to approved theme or compatibility directories.
Attack traffic followed the disclosure
This is not a theoretical patch-cycle risk. CVE-2026-87902 is being exploited in the wild and was added to CISA’s KEV catalog on September 25, 2026; the catalog requires federal agencies to remediate by September 28 and perform forensic triage. CISA records ransomware use as unknown. Observed activity progressed from detection probes to pearcmd.php inclusion attempts, writes of attacker-controlled PHP under temporary directories, and shell-command execution attempts.
A public proof of concept and vulnerable lab exists, alongside other public tooling. No named victim, attributed actor or named campaign could be confirmed from the reviewed material.
Upgrade every supported branch and investigate exposure
WordPress shipped the mainline fix in 7.1.2 on September 22, 2026, and backported it through supported branches to 4.7. Sites on 7.1.0–7.1.1 should move to 7.1.2; teams on older maintained releases should install the corresponding security release rather than assuming a theme change is sufficient. The advisory does not confirm whether unsupported 4.6 and earlier releases contain this flaw.
Treat internet-facing WordPress installations with affected versions as urgent patch-and-hunt work: review access logs for suspicious template requests, inspect /tmp and /var/tmp for unexpected PHP, and check for new files or web-server-process activity. For teams that need this tied to what they actually operate, SecAlerts monitors an organisation’s software stack and alerts on new vulnerabilities affecting the products it runs.
