{"id":"CVE-2026-87902","aliases":["BIT-wordpress-2026-87902","BIT-wordpress-multisite-2026-87902","DEBIAN-CVE-2026-87902","EUVD-2026-84555","GHSA-7hp8-65ch-5whp","UBUNTU-CVE-2026-87902"],"status":"published","title":"WordPress Core Remote File Inclusion Vulnerability","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.95769,"percentile":0.99872,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-98"],"published":"2026-09-22T16:44:15Z","modified":"2026-11-06T10:56:03Z","kev":{"date_added":"2026-09-25","due_date":"2026-09-28","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-09-23"},{"source":"kev","since":"2026-09-25"}],"exploits":[{"source":"pocgithub","id":"abraxas/CVE-2026-87902","title":"abraxas/CVE-2026-87902","date":"2026-09-22","url":"https://github.com/abraxas/CVE-2026-87902"},{"source":"pocgithub","id":"pwnVader/CVE-2026-87902-PoC-pwnVader","title":"pwnVader/CVE-2026-87902-PoC-pwnVader","date":"2026-09-22","url":"https://github.com/pwnVader/CVE-2026-87902-PoC-pwnVader"},{"source":"pocgithub","id":"ressl/cve-2026-87902-poc","title":"ressl/cve-2026-87902-poc","date":"2026-09-22","url":"https://github.com/ressl/cve-2026-87902-poc"},{"source":"pocgithub","id":"vulpecuna/CVE-2026-87902","title":"vulpecuna/CVE-2026-87902","date":"2026-09-22","url":"https://github.com/vulpecuna/CVE-2026-87902"},{"source":"pocgithub","id":"Hassham1/CVE-2026-87902","title":"Hassham1/CVE-2026-87902","date":"2026-09-23","url":"https://github.com/Hassham1/CVE-2026-87902"},{"source":"pocgithub","id":"bhideki/CVE-2026-87902","title":"bhideki/CVE-2026-87902","date":"2026-09-23","url":"https://github.com/bhideki/CVE-2026-87902"},{"source":"pocgithub","id":"dinosn/cve-2026-87902-wordpress-lfi-lab","title":"dinosn/cve-2026-87902-wordpress-lfi-lab","date":"2026-09-23","url":"https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab"},{"source":"pocgithub","id":"rabakuku/CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal","title":"rabakuku/CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal","date":"2026-09-23","url":"https://github.com/rabakuku/CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal"},{"source":"pocgithub","id":"tc4dy/CVE-2026-87902-Toolkit","title":"tc4dy/CVE-2026-87902-Toolkit","date":"2026-09-23","url":"https://github.com/tc4dy/CVE-2026-87902-Toolkit"},{"source":"pocgithub","id":"ynsmroztas/WPSniper","title":"ynsmroztas/WPSniper","date":"2026-09-23","url":"https://github.com/ynsmroztas/WPSniper"},{"source":"pocgithub","id":"zer0dayf/CVE-2026-87902","title":"zer0dayf/CVE-2026-87902","date":"2026-09-23","url":"https://github.com/zer0dayf/CVE-2026-87902"},{"source":"pocgithub","id":"nextco/wordpress-cve-2026-87902","title":"nextco/wordpress-cve-2026-87902","date":"2026-09-24","url":"https://github.com/nextco/wordpress-cve-2026-87902"},{"source":"pocgithub","id":"zyphorixofficialmain-lab/cve-2026-87902","title":"zyphorixofficialmain-lab/cve-2026-87902","date":"2026-09-24","url":"https://github.com/zyphorixofficialmain-lab/cve-2026-87902"},{"source":"pocgithub","id":"SVTagan/WP-CVE-2026-87902","title":"SVTagan/WP-CVE-2026-87902","date":"2026-09-25","url":"https://github.com/SVTagan/WP-CVE-2026-87902"},{"source":"pocgithub","id":"crowsec-edtech/CVE-2026-87902","title":"crowsec-edtech/CVE-2026-87902","date":"2026-09-25","url":"https://github.com/crowsec-edtech/CVE-2026-87902"},{"source":"pocgithub","id":"joaovicdev/EXPLOIT-CVE-2026-87902","title":"joaovicdev/EXPLOIT-CVE-2026-87902","date":"2026-09-25","url":"https://github.com/joaovicdev/EXPLOIT-CVE-2026-87902"},{"source":"pocgithub","id":"itskill-jp/wordpress-upgrade-check","title":"itskill-jp/wordpress-upgrade-check","date":"2026-09-26","url":"https://github.com/itskill-jp/wordpress-upgrade-check"},{"source":"pocgithub","id":"rwxrwxs/CVE-2026-87902","title":"rwxrwxs/CVE-2026-87902","date":"2026-09-26","url":"https://github.com/rwxrwxs/CVE-2026-87902"},{"source":"pocgithub","id":"Maalfer/CVE-2026-87902-exploit","title":"Maalfer/CVE-2026-87902-exploit","date":"2026-09-27","url":"https://github.com/Maalfer/CVE-2026-87902-exploit"},{"source":"pocgithub","id":"abatsakidis/wp-cve-2026-87902-checker","title":"abatsakidis/wp-cve-2026-87902-checker","date":"2026-09-27","url":"https://github.com/abatsakidis/wp-cve-2026-87902-checker"},{"source":"pocgithub","id":"langz337/CVE-2026-87902","title":"langz337/CVE-2026-87902","date":"2026-09-27","url":"https://github.com/langz337/CVE-2026-87902"},{"source":"pocgithub","id":"HackfutSecRoot/CVE-2026-87902","title":"HackfutSecRoot/CVE-2026-87902","date":"2026-09-28","url":"https://github.com/HackfutSecRoot/CVE-2026-87902"},{"source":"pocgithub","id":"tonydelouvre/CVE-2026-87902","title":"tonydelouvre/CVE-2026-87902","date":"2026-09-29","url":"https://github.com/tonydelouvre/CVE-2026-87902"},{"source":"exploitdb","id":"EDB-52690","title":"WordPress 7.0.2 - Path Travesal","type":"webapps","platform":"multiple","date":"2026-10-01","url":"https://www.exploit-db.com/exploits/52690"},{"source":"pocgithub","id":"xiaxiu555/cve-2026-87902","title":"xiaxiu555/cve-2026-87902","date":"2026-10-07","url":"https://github.com/xiaxiu555/cve-2026-87902"},{"source":"nuclei","id":"CVE-2026-87902","title":"WordPress Core - PHP Template Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml"}],"fixes":[{"ecosystem":"Bitnami","package":"wordpress","fixed_in":["7.1.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"wordpress-multisite","fixed_in":["7.1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["6.8.10+dfsg1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["7.1.2+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"wordpress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"wordpress-multisite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+dfsg1-1","6.1.6+dfsg1-0+deb12u1","6.1.9+dfsg1-0+deb12u1","6.2+dfsg1-1","6.2.1+dfsg1-1","6.2.2+dfsg1-1","6.3+dfsg1-1","6.3.1+dfsg1-1","6.3.2+dfsg1-1","6.4.1+dfsg1-1","6.4.1+dfsg1-1.1","6.4.2+dfsg1-1","6.4.3+dfsg1-1","6.5+dfsg1-1","6.5.2+dfsg1-1","6.5.3+dfsg1-1","6.5.5+dfsg1-1","6.6.1+dfsg1-1","6.7.2+dfsg1-1","6.7.2+dfsg1-1.1","6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1","7.1.1+dfsg1-1","7.1.2+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.10+dfsg1-0+deb13u1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-0+deb13u1","6.8.3+dfsg1-1","6.8.6+dfsg1-0+deb13u1","6.8.7+dfsg1-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+dfsg1-1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1","7.1.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"wordpress","product":"core"},{"vendor":"wordpress","product":"wordpress"},{"vendor":"wordpress foundation","product":"wordpress"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","tags":["Vendor Advisory","advisory","report"]},{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87902.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-87902","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-87902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87902","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-22T16:44:15.048Z","modified":"2026-09-26T03:55:51.56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-84555","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-22T16:44:15Z","modified":"2026-09-26T03:55:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2026-09-23","updated_at":"2026-11-02T17:27:54.622662Z"}],"kev":[{"id":"CVE-2026-87902","title":"WordPress Core Remote File Inclusion Vulnerability","description":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","cwes":["CWE-98"],"kev":{"date_added":"2026-09-25","due_date":"2026-09-28","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-22T17:17:28.31Z","modified":"2026-09-28T12:20:54.04Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-22T16:44:15.048Z","modified":"2026-11-08T02:47:43.902529266Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-98"],"updated_at":"2026-11-07T03:08:11.522761Z"},{"id":"DEBIAN-CVE-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-22T17:17:28.31Z","modified":"2026-10-01T04:00:06.881997505Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"UBUNTU-CVE-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-22T17:17:00Z","modified":"2026-10-17T13:01:14.965868206Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"BIT-wordpress-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-29T09:00:28.803Z","modified":"2026-11-06T10:56:03.747292718Z","updated_at":"2026-11-06T11:08:47.346964Z"},{"id":"BIT-wordpress-multisite-2026-87902","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","status":"published","published":"2026-09-29T09:00:30.549Z","modified":"2026-11-06T10:56:03.747292718Z","updated_at":"2026-11-06T11:08:47.346964Z"}]}}