CVE-2026-87902 - WordPress Local File Inclusion Vulnerability
Posted: Wed Sep 23, 2026 3:38 pm
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
NVD Published Date:
Sep 22, 2026
More information:
https://nvd.nist.gov/vuln/detail/cve-2026-87902
NVD Published Date:
Sep 22, 2026
More information:
https://nvd.nist.gov/vuln/detail/cve-2026-87902