EXPLOIT/ALERT Back to feed

WordPress vulnerability

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Published 22 Sep 2026Updated 26 Sep 20262814 sources
CVSS 8.1 ✓ VERIFIED REFERENCE△ CISA KEV
Overview Sources History

What happened

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Affected versions

WordPress: before 7.1.2 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

RepositoryAuthorFirst seenReference
SploitusProof-of-concept exploit for CVE-2026-87902. CVSS 8.1.Sploitus index2026-09-22T21:20:00+00:00VerifiedSploitusProof-of-concept exploit for CVE-2026-87902. CVSS 8.1.Sploitus index2026-09-22T19:57:40+00:00CandidateSploitusProof-of-concept exploit for CVE-2026-87902. CVSS 8.1.Sploitus index2026-09-22T18:40:26+00:00CandidateSploitusProof-of-concept exploit for CVE-2026-87902. CVSS 8.1.Sploitus index2026-09-22T18:32:56+00:00CandidateSploitusProof-of-concept exploit for CVE-2026-87902. CVSS 8.1.Sploitus index2026-09-22T18:13:48+00:00CandidateTheeEclipse/CVE-2026-87902-POCUnauthenticated RCE in WordPress Core via path traversal chained to PEAR pearcmd.php.TheeEclipse2026-09-22T21:20:57Candidategriisemine/cve-2026-87902-detectionUnauthenticated path traversal in WordPress page-template resolution leading to RCE.griisemine2026-09-22T19:59:05Verifiedressl/cve-2026-87902-pocUnauthenticated PHP code execution in WordPress Core via double-encoded pagename traversal.ressl2026-09-22T18:45:13Verifiedvulpecuna/CVE-2026-87902vulpecuna2026-09-22T21:06:42Verifiedabraxas/CVE-2026-87902abraxas2026-09-22T18:14:13VerifiedSploitusUnauthenticated LFI in WordPress core pagename resolution allows local RCE.pwnVader2026-09-22T22:59:22VerifiedpwnVader/CVE-2026-87902-PoC-pwnVaderUnauthenticated LFI in WordPress core pagename resolution allows local RCE.pwnVader2026-09-22T22:59:22VerifiedSploitusUnauthenticated LFI to RCE in WordPress 4.7.0–7.1.1 via get_page_template() path traversal.dinosn2026-09-23T05:20:16Verifieddinosn/cve-2026-87902-wordpress-lfi-labUnauthenticated LFI to RCE in WordPress 4.7.0–7.1.1 via get_page_template() path traversal.dinosn2026-09-23T05:20:16VerifiedSploitusLutfifakee-Project2026-09-23T21:08:44CandidateLutfifakee-Project/CVE-2026-87902Lutfifakee-Project2026-09-23T21:08:44CandidateSploituszyphorixofficialmain-lab2026-09-24T14:13:09Verifiedzyphorixofficialmain-lab/cve-2026-87902zyphorixofficialmain-lab2026-09-24T14:13:09VerifiedSploitusUnauthenticated LFI in Visual Composer via vcv-template validation flaw.Hassham12026-09-24T17:48:27VerifiedHassham1/CVE-2026-12227-visualcomposer-lfi-pocUnauthenticated LFI in Visual Composer via vcv-template validation flaw.Hassham12026-09-24T17:48:27VerifiedSploitusUnauthenticated LFI to conditional RCE in WordPress Core 4.7.0-7.1.1 via pagename.langz3372026-09-27T12:06:10Verifiedlangz337/CVE-2026-87902Unauthenticated LFI to conditional RCE in WordPress Core 4.7.0-7.1.1 via pagename.langz3372026-09-27T12:06:10VerifiedSploitusUnauthenticated RCE in WordPress 4.7.0–7.1.1 via LFI in locate_template() and pearcmd.php.Maalfer2026-09-27T20:40:55VerifiedSploitusTools for local and remote assessment of CVE-2026-87902 in WordPress installations.abatsakidis2026-09-27T18:21:18VerifiedMaalfer/CVE-2026-87902-exploitUnauthenticated RCE in WordPress 4.7.0–7.1.1 via LFI in locate_template() and pearcmd.php.Maalfer2026-09-27T20:40:55Verifiedabatsakidis/wp-cve-2026-87902-checkerTools for local and remote assessment of CVE-2026-87902 in WordPress installations.abatsakidis2026-09-27T18:21:18VerifiedSploitusHackfutSecRoot2026-09-28T17:14:59VerifiedHackfutSecRoot/CVE-2026-87902HackfutSecRoot2026-09-28T17:14:59VerifiedSploitusUnauthenticated LFI in WordPress core via get_page_template() leads to RCE.tonydelouvre2026-09-29T20:25:03Verifiedtonydelouvre/CVE-2026-87902Unauthenticated LFI in WordPress core via get_page_template() leads to RCE.tonydelouvre2026-09-29T20:25:03VerifiedSploitusProofCMS toolkit detects and validates vulnerabilities in Joomla and WordPress.MRdark-ops2026-09-29T16:23:00VerifiedMRdark-ops/ProofCMS-ProofCMS toolkit detects and validates vulnerabilities in Joomla and WordPress.MRdark-ops2026-09-29T16:23:00VerifiedExploit-DB 52690WordPress 7.0.2 - Path TravesalRobert Ressl2026-10-01Verified
CorrectionsReport an issue