Search/CVE-2026-87902
● CVE — High

CVE-2026-87902

VendorwordpressProductwordpressDiscoveredSep 22, 2026UpdatedSep 28, 2026

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

View graph Watch Export
CVSS v3.1
8.1 HIGH
EPSS
40.0%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
11
sources referencing this CVE
Related IOCs
12
seen in the same coverage
EPSS Trend
Sep 24, 2026 → Oct 22, 2026
▲ 39.6pp
0.42% → 40.0% over 7 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
17 relationships
Timeline
disclosure → media coverage
Sep 22, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 28, 2026
Sep 22, 2026
thehackernews.com reports: WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Sep 23, 2026
acn.gov.it reports: WordPress: PoC pubbliche per lo sfruttamento di nuove vulnerabilità
Sep 23, 2026
bleepingcomputer.com reports: Hackers start exploiting critical WordPress flaw for code execution
Sep 24, 2026
thehackernews.com reports: Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Sep 24, 2026
securityweek.com reports: Critical WordPress Vulnerability Exploited Immediately After Disclosure
Sep 24, 2026
advisories.ncsc.nl reports: NCSC-2026-0389 [1.01] [M/H] Kwetsbaarheid verholpen in WordPress
Sep 25, 2026
kaspersky.com reports: CVE-2026-87902: Critical Vulnerability in WordPress
Sep 27, 2026
helpnetsecurity.com reports: Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Sep 28, 2026
research.checkpoint.com reports: 28th September – Threat Intelligence Report
Sep 28, 2026
thehackernews.com reports: ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Oct 1, 2026
exploit-db.com reports: [webapps] WordPress 7.0.2 - Path Travesal
Public PoC (10)
github.com/abraxas/CVE-2026-87902github.com/vulpecuna/CVE-2026-87902github.com/ressl/cve-2026-87902-pocgithub.com/pwnVader/CVE-2026-87902-PoC-pwnVadergithub.com/rabakuku/CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversalgithub.com/dinosn/cve-2026-87902-wordpress-lfi-labgithub.com/zer0dayf/CVE-2026-87902github.com/Hassham1/CVE-2026-87902github.com/ynsmroztas/WPSnipergithub.com/bhideki/CVE-2026-87902
Unverified third-party code — review before executing.