Vulnerability Intelligence Report
WordPress Core Remote File Inclusion Vulnerability
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
CVSS Base Score
8.1
HIGH
Exploitability:2.3
Impact Score:5.9
EPSS Probability:2.88%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-98 ↗CWE-98 Remote File Inclusion
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| WordPress | WordPress | 0 < 7.1.2 (affected) |
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
2.877%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | HackerOne · Bug Bounty Provider · USA |
| Reserved | 2026-09-09T15:00:00 |
| Published | 2026-09-22T16:44:15 |
| Last Updated | 2026-09-25T19:58:24 |
Community Chatter & Buzz