high CVSS 8.1 Actively exploited EPSS 46% Public exploit available

CVE-2026-87902·WordPress vulnerability

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Severity
high
Software
WordPress
Fixed in
7.1.2
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 46% — in the top 1% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 7.1

Until: 7.1.2

Fixed in: 7.1.2

How to fix this CVE

WordPress sites running versions 7.1 through 7.1.1 must be updated to version 7.1.2 or later immediately to address a critical template resolution flaw. This vulnerability allows unauthenticated attackers to include arbitrary PHP files from the server filesystem, potentially leading to remote code execution under specific server and theme configurations. Update WordPress through the admin dashboard or via command line to patch the vulnerable `get_page_template()` function.

sudo dnf update wordpress

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST requests containing template path parameters with traversal sequences (../ or encoded variants) or absolute file paths pointing to system PHP files (e.g., `/etc/passwd`, `/var/www/html/index.php`); pattern: `[?&]template=.*(\.\./|%2e%2e%2f|/etc/|/var/www)`

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block HTTP requests containing template parameter values with path traversal sequences or file:// URIs; implement rule: deny if query string matches `template.*(\.\./|%252e%252e%252f|/etc/|/var/www|file://)`; whitelist only expected template names from active theme directory

How to check if you are affected

  1. Step 1: Check WordPress version via SSH: `grep 'wp_version = ' /var/www/html/wp-includes/version.php | grep -oP "\d+\.\d+\.\d+"`
  2. Step 2: Verify if custom themes are using `get_page_template()` by searching theme files: `grep -r "get_page_template" /var/www/html/wp-content/themes/`
  3. Step 3: Search web server logs for suspicious template parameter requests: `grep -i "template=" /var/log/apache2/access.log | grep -v ".css\|.js\|.jpg\|.png`
  4. Step 4: After patching, confirm the update with: `sudo -u www-data wp core version` (if WP-CLI is installed) or verify via WordPress admin dashboard Settings > General

Indicators of compromise

  • Requests with parameter: template=../../../../etc/passwd
  • Requests with parameter: template=/var/www/html/wp-load.php
  • Requests with parameter: template=file:///etc/php.ini
  • HTTP 200 responses containing PHP error messages or output from unauthorized file inclusion

FAQ

What is CVE-2026-87902?

CVE-2026-87902 is a path traversal vulnerability in WordPress that exploits insecure template resolution to include readable PHP files outside the intended theme directories, potentially enabling remote code execution when combined with certain server configurations and theme structures.

Is CVE-2026-87902 being actively exploited?

Yes—this vulnerability is actively exploited in the wild according to CISA's Known Exploited Vulnerabilities catalog, with public exploits available and reconnaissance activity reported within hours of the initial patch release.

What versions of WordPress are affected by CVE-2026-87902?

WordPress versions 7.1.0 through 7.1.1 are vulnerable. Version 7.1.2 and all later releases contain the necessary security patches.

How do I check if my server is vulnerable to CVE-2026-87902?

Run `grep 'wp_version = ' /var/www/html/wp-includes/version.php` and verify if your version is between 7.1.0 and 7.1.1; if so, your site is vulnerable and requires immediate patching.

Does Defensia detect CVE-2026-87902?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If WordPress is installed on a monitored server, CVE-2026-87902 will appear in your dashboard with remediation steps.

Related WordPress CVEs

CVE-2026-63030CVSS 9.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVE-2026-60137CVSS 5.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-87902. Free for 1 server.

Get started free