Published on October 20, 2026 at 3:08 PM

The vulnerability identified as CVE-2026-87902 is a significant concern for WordPress users, particularly due to its potential for exploitation by unauthenticated attackers. This vulnerability resides in the WordPress core’s get_page_template() function, which can be manipulated to include unintended files.

What the vulnerability is

CVE-2026-87902 involves the get_page_template() function in WordPress, which is responsible for resolving page templates. An attacker can abuse this function to include a chosen readable local PHP file that is located outside the active theme’s directories. This manipulation can occur without authentication, making it a critical issue for affected systems.

Technical details

While specific technical details such as the CVSS score, CWE classification, and attack vector have not been published yet, the vulnerability is classified as a local file inclusion (LFI) issue. The lack of a distinguishing HTTP request/response signature for the vulnerable code path means that detecting this vulnerability requires careful version checking rather than direct probing.

Impact

The primary risk associated with CVE-2026-87902 is the inclusion of unintended PHP files, which under certain conditions, could escalate to remote code execution. This escalation depends on specific server configurations and active theme preconditions, highlighting the importance of understanding your server environment.

Affected systems

Affected systems have not been publicly disclosed at the time of writing. Users are advised to verify their WordPress installation versions against the advisory for CVE-2026-87902 to determine if they are at risk.

Mitigation

Currently, there is no specific patch information available for CVE-2026-87902. Users should ensure their WordPress installations are up to date and monitor official WordPress channels for any updates or patches related to this vulnerability.

In conclusion, continuous scanning and version verification are crucial in identifying potential vulnerabilities like CVE-2026-87902 before they can be exploited by attackers. Regular updates and adherence to security best practices can mitigate the risks associated with such vulnerabilities.