PHP file inclusion in WordPress - CVE-2026-87902
Published: September 23, 2026 / Updated: September 25, 2026
Vulnerability identifier: #VU151804
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87902
CWE-ID: CWE-98
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of the filename for a PHP include statement in get_page_template() page-template resolution when resolving a page template. A remote attacker can cause a chosen readable local PHP file outside the active theme directories to be included to execute arbitrary code.
Exploitation requires an active child or parent theme with a top-level directory whose name begins with "page-" and a chosen local PHP file that is readable by the web server account.
Affected software
WordPress
Fedora
wordpress
Fedora
wordpress
How to mitigate CVE-2026-87902
Install security update from vendor's website.
WordPress - addressed in versions 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2
wordpress - addressed in versions 6.9.9-1.el9, 6.9.9-1.el10_2, 6.9.9-1.fc43, 6.9.9-1.fc44, 7.1.2-1.el10_3, 7.1.2-1.el10_4, 7.1.2-1.fc45
wordpress - addressed in versions 6.9.9-1.el9, 6.9.9-1.el10_2, 6.9.9-1.fc43, 6.9.9-1.fc44, 7.1.2-1.el10_3, 7.1.2-1.el10_4, 7.1.2-1.fc45