Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-87902 Published 2026-09-22 Updated 25 days ago Vendor/s WordPress Product/s Core Version/s \* > 4.7.37 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 8.1 / 10 High Severity Details Base score 8.1 High Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability High Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description CVE-2026-87902 is a high-severity RCE vulnerability in WordPress Core (CVSS 8.1) actively exploited in the wild. Update affected versions immediately. ## Why this matters "CVE-2026-87902 is a high-severity vulnerability in WordPress Core with a CVSS score of 8.1. It is particularly critical because it is listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating that attackers are actively leveraging this flaw in the wild. An unauthenticated attacker can exploit the get\_page\_template() function to include arbitrary local PHP files, which, under certain conditions, leads to full Remote Code Execution (RCE). Given WordPress's massive global footprint, this flaw poses a significant risk to millions of websites, making immediate patching essential to prevent unauthorized server compromise and data breaches." ## CPE WordPress | Product | Version Start | Version End (excl.) | Status | | --------- | ------------- | ------------------- | ---------- | | wordpress | \* | 4.7.37 | vulnerable | | wordpress | 4.8 | 4.8.32 | vulnerable | | wordpress | 4.9 | 4.9.33 | vulnerable | | wordpress | 5.0 | 5.0.29 | vulnerable | | wordpress | 5.1 | 5.1.26 | vulnerable | | wordpress | 5.2 | 5.2.28 | vulnerable | | wordpress | 5.3 | 5.3.25 | vulnerable | | wordpress | 5.4 | 5.4.23 | vulnerable | | wordpress | 5.5 | 5.5.22 | vulnerable | | wordpress | 5.6 | 5.6.21 | vulnerable | | wordpress | 5.7 | 5.7.19 | vulnerable | | wordpress | 5.8 | 5.8.17 | vulnerable | | wordpress | 5.9 | 5.9.18 | vulnerable | | wordpress | 6.0 | 6.0.16 | vulnerable | | wordpress | 6.1 | 6.1.14 | vulnerable | | wordpress | 6.2 | 6.2.13 | vulnerable | | wordpress | 6.3 | 6.3.12 | vulnerable | | wordpress | 6.4 | 6.4.12 | vulnerable | | wordpress | 6.5 | 6.5.12 | vulnerable | | wordpress | 6.6 | 6.6.9 | vulnerable | | wordpress | 6.7 | 6.7.9 | vulnerable | | wordpress | 6.8 | 6.8.10 | vulnerable | | wordpress | 6.9 | 6.9.9 | vulnerable | | wordpress | 7.0 | 7.0.6 | vulnerable | | wordpress | 7.1 | 7.1.2 | vulnerable | ## Related weakness (CWE) CWE-98 ## Remediation plan 1 ### Apply official patches WordPress has released security updates across all affected branches. Administrators should immediately apply the latest security releases provided by the WordPress development team (e.g., versions 7.1.3, 7.0.7, 6.9.10, or higher) to address the flaw in the template resolution logic. 2 ### Update affected systems Ensure all WordPress installations are updated to versions beyond the vulnerable ranges. This includes updating systems running versions 4.7.x through 7.1.2 to their respective patched minor releases as specified in the vendor's security advisory. 3 ### Restrict access Deploy a Web Application Firewall (WAF) with rules designed to block directory traversal and malicious template parameter manipulation. Additionally, enforce strict file system permissions to ensure the web server process cannot read PHP files outside of the intended application directories. 4 ### Monitor for exploitation Review web server access logs for suspicious requests involving the get\_page\_template function or directory traversal sequences (../). Audit system logs for unexpected PHP execution or unauthorized file access attempts originating from the web server user. ## Detection Guidance "To detect exploitation of CVE-2026-87902, monitor web server logs for HTTP requests containing directory traversal patterns or absolute paths in parameters related to page templates. Look for unauthenticated requests that attempt to include PHP files located outside the active theme directory. Security teams should also utilize WAF signatures that identify common Local File Inclusion (LFI) techniques and monitor for unusual outbound network connections from the WordPress host which may indicate a successful RCE payload." ## References [https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp Vendor Advisory ](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp)[https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/ Third Party Advisory ](https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-87902 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)