CVE-2026-87902
highpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · NCSC-NLEPSS 0.958 · 100 %ileexploit · PoCDENLRUUSadded 2026-09-25remediate by 2026-09-28
required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
EU KEVflagged by NCSC-NLreported 2026-09-23patched 2026-09-22
The vulnerabilitycan be exploited by an attacker without login credentials to have a special file loaded outside the normal themes of WordPress. Active abuse has been observed.
EPSS · scored 2026-10-27
WordPress Core Remote File Inclusion Vulnerability
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (26)
Public proof-of-concept and weaponised exploit code.
- EDB-52690WordPress 7.0.2 - Path TravesalPoC · exploit_db
- MRdark-ops/CVE-2026-87902CVE-2026-87902 — WordPress Core LFI → RCEPoC · poc_in_github
- SVTagan/WP-CVE-2026-87902WordPress CVE-2026-87902 diagnostic checkPoC · poc_in_github
affected products (80)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0389 Kwetsbaarheid verholpen in WordPressNL2026-09-23csaf · ncsc_nlNL
De ontwikkelaars van WordPress hebben een kwetsbaarheid verholpen in WordPress.
- WID-SEC-W-2026-3539WordPress: Schwachstelle ermöglicht CodeausführungDeutsch2026-09-23csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WordPress ausnutzen, um beliebigen Programmcode auszuführen.
- BIT-wordpress-2026-879022026-09-29vendor · osvUS
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
- BIT-wordpress-multisite-2026-879022026-09-29vendor · osvUS
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
also known as (4)
Other names and identifiers for this entity.
- BDU:2026-15200fstec_bdu
- GHSA-7hp8-65ch-5whpfstec_bdu
- BIT-wordpress-2026-87902osv
- BIT-wordpress-multisite-2026-87902osv
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whpVendor Advisory
- https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902US Government Resource
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan