- High 8.1
- Known exploited (CISA KEV)
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Scores
The facts
- Published
- 22 September 2026
- Last changed
- 28 September 2026
- NVD status
- Analyzed
- Severity
- High, CVSS 8.1 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- Affects
- wordpress wordpress
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 September 2026.
- EPSS
- 40.0% chance of exploitation activity in the next 30 days (percentile 99).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.
Scan your domain to see whether this software is visible from the internet. A clear result does not prove you are safe.