CVE-2026-87902: High severity WordPress WordPress vulnerability
Published Sep 22, 2026
·Updated
An unauthenticated attacker can make getpagetemplate() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Affected Software
1 affected component
WordPress WordPress
Event History
Sep 22, 2026
CVE Published
via MITRE·04:44 PM
Data Sourced
via MITRE·04:44 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is authentication required to exploit this issue?
No. The issue can be triggered by an unauthenticated attacker.
2
Does successful exploitation always result in remote code execution?
No. Remote code execution is possible only when relevant preconditions in both the server environment and the active theme are met.
3
What part of the WordPress installation is relevant to exposure?
Exposure involves page-template resolution and the active theme directories. The impact depends on whether the server and active theme meet the necessary preconditions.