CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
An unauthenticated attacker can make getpagetemplate() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Other sources
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution.
— CISA
Affected Software
Event History
Frequently Asked Questions
Is authentication required to exploit this issue?
No. The issue can be triggered by an unauthenticated attacker.
Does successful exploitation always result in remote code execution?
No. Remote code execution is possible only when relevant preconditions in both the server environment and the active theme are met.
What part of the WordPress installation is relevant to exposure?
Exposure involves page-template resolution and the active theme directories. The impact depends on whether the server and active theme meet the necessary preconditions.