An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
NVD Published Date:
Sep 22, 2026
More information:
https://nvd.nist.gov/vuln/detail/cve-2026-87902
CVE-2026-87902 - WordPress Local File Inclusion Vulnerability
-
Starburst-David
- Posts: 405
- Joined: Wed Feb 11, 2026 8:31 pm