{"id":"CVE-2026-87902","title":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories","summary":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-98"],"vendor":"WordPress","product":"WordPress","affected":["WordPress < 7.1.2"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:00:03.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902","references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","label":"support@hackerone.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-22T16:56:15.222399Z"},"ingestedAt":"2026-09-22T17:07:07.379Z","exploits":{"github":2,"githubRepos":["https://github.com/abraxas/CVE-2026-87902","https://github.com/ressl/cve-2026-87902-poc","https://github.com/vulpecuna/CVE-2026-87902"],"checkedAt":"2026-09-23T07:15:11.823Z"},"exploitAvailable":true,"slug":"CVE-2026-87902","body":"## Overview\n\nAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":209516,"id":"CVE-2026-87902","ts":1790149748479,"field":"exploit_available","old":"false","new":"true"}]}