CVE-2026-87902 – WordPress
CVSS 8.1
IMPORTANT
[1] Zero-Day – Immediate Deployment
“One unauthenticated request can make a trusted website run code it was never meant to load.”
This WordPress update fixes a local file inclusion flaw in page-template resolution. CVE-2026-87902 has a CVSS score of 8.1, High severity. An unauthenticated attacker can make the get_page_template() function include a readable local .php file of their choice from outside the active theme directories. When certain server and active-theme conditions are met, the flaw can lead to remote code execution.
Attackers are actively exploiting CVE-2026-87902. No login is required, so any public-facing WordPress site is exposed. Apply this update right away to close the attack path before attackers reach your sites.
Key Details
- Affected Product
- Wordpress Wordpress
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-98
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.