CVE-2026-87902 WordPress WordPress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead…
- CVSS
- 8.1 High
- EPSS
- 96%
- Percentile
- 100
- Published
- 2026-09-22
- Force
- 10 of 12
- Public PoC
- 24
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
WordPress Core Remote File Inclusion Vulnerability
- Added
- 2026-09-25
- Federal patch deadline
- 2026-09-28
- Ransomware use
- not known