CVE-2026-87902
Description
CVE-2026-87902 is a high-severity RCE vulnerability in WordPress Core (CVSS 8.1) actively exploited in the wild. Update affected versions immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| wordpress | * | 4.7.37 | vulnerable |
| wordpress | 4.8 | 4.8.32 | vulnerable |
| wordpress | 4.9 | 4.9.33 | vulnerable |
| wordpress | 5.0 | 5.0.29 | vulnerable |
| wordpress | 5.1 | 5.1.26 | vulnerable |
| wordpress | 5.2 | 5.2.28 | vulnerable |
| wordpress | 5.3 | 5.3.25 | vulnerable |
| wordpress | 5.4 | 5.4.23 | vulnerable |
| wordpress | 5.5 | 5.5.22 | vulnerable |
| wordpress | 5.6 | 5.6.21 | vulnerable |
| wordpress | 5.7 | 5.7.19 | vulnerable |
| wordpress | 5.8 | 5.8.17 | vulnerable |
| wordpress | 5.9 | 5.9.18 | vulnerable |
| wordpress | 6.0 | 6.0.16 | vulnerable |
| wordpress | 6.1 | 6.1.14 | vulnerable |
| wordpress | 6.2 | 6.2.13 | vulnerable |
| wordpress | 6.3 | 6.3.12 | vulnerable |
| wordpress | 6.4 | 6.4.12 | vulnerable |
| wordpress | 6.5 | 6.5.12 | vulnerable |
| wordpress | 6.6 | 6.6.9 | vulnerable |
| wordpress | 6.7 | 6.7.9 | vulnerable |
| wordpress | 6.8 | 6.8.10 | vulnerable |
| wordpress | 6.9 | 6.9.9 | vulnerable |
| wordpress | 7.0 | 7.0.6 | vulnerable |
| wordpress | 7.1 | 7.1.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
WordPress has released security updates across all affected branches. Administrators should immediately apply the latest security releases provided by the WordPress development team (e.g., versions 7.1.3, 7.0.7, 6.9.10, or higher) to address the flaw in the template resolution logic.
Update affected systems
Ensure all WordPress installations are updated to versions beyond the vulnerable ranges. This includes updating systems running versions 4.7.x through 7.1.2 to their respective patched minor releases as specified in the vendor's security advisory.
Restrict access
Deploy a Web Application Firewall (WAF) with rules designed to block directory traversal and malicious template parameter manipulation. Additionally, enforce strict file system permissions to ensure the web server process cannot read PHP files outside of the intended application directories.
Monitor for exploitation
Review web server access logs for suspicious requests involving the get_page_template function or directory traversal sequences (../). Audit system logs for unexpected PHP execution or unauthorized file access attempts originating from the web server user.
Detection Guidance
"To detect exploitation of CVE-2026-87902, monitor web server logs for HTTP requests containing directory traversal patterns or absolute paths in parameters related to page templates. Look for unauthenticated requests that attempt to include PHP files located outside the active theme directory. Security teams should also utilize WAF signatures that identify common Local File Inclusion (LFI) techniques and monitor for unusual outbound network connections from the WordPress host which may indicate a successful RCE payload."