{"id":"CVE-2026-87902","state":"PUBLISHED","title":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pr","description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","publishedAt":"2026-09-22T16:44:15.048Z","updatedAt":"2026-09-26T03:55:51.560Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"hackerone","products":["WordPress WordPress"],"affected":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.1.2","versionType":"semver"}]}],"references":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"],"weaknesses":["CWE-98"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/87xxx/CVE-2026-87902.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-87902","state":"PUBLISHED","datePublished":"2026-09-22T16:44:15.048Z","dateUpdated":"2026-09-26T03:55:51.560Z","assignerShortName":"hackerone","assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","dateReserved":"2026-09-09T15:00:00.574Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE."}],"affected":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.1.2","versionType":"semver"}]}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-98","type":"CWE","lang":"en","description":"CWE-98 Remote File Inclusion"}]}],"providerMetadata":{"shortName":"hackerone","orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","dateUpdated":"2026-09-22T16:44:15.048Z"},"credits":[{"lang":"en","value":"Robert (ressl)","type":"finder"}],"workarounds":[{"lang":"en","value":"WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7."}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","tags":["third-party-advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-25T00:00:00+00:00","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-87902"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-09-25","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-26T03:55:51.560Z"},"timeline":[{"time":"2026-09-25T00:00:00.000Z","lang":"en","value":"CVE-2026-87902 added to CISA KEV"}]}]}}}