CVE-2026-87902

WordPress unauthenticated file inclusion in page template lookup

high · 8.1

Known exploited

Fix listed

WordPress

Published Sep 22, 2026, 16:44 UTC

Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Reported fixed versions

7.1.2

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.