WordPress Core Remote File Inclusion Vulnerability

🚨SEVERITY: HIGH — CVSS 8.1Security Advisory

TL;DR 📌

  • WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution.
  • Highest CVSS: 8.1 (High).
  • Listed in CISA KEV (2026-09-25) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-87902.

What it is

CVE-2026-87902 is a remote file inclusion flaw in WordPress Core, specifically in the page-template resolution logic behind get_page_template(). This function is responsible for locating which template file a page should use.

An unauthenticated attacker can manipulate that resolution so it includes a .php file of their choosing from outside the active theme’s directories, provided that file exists on the local filesystem and is readable. No login, session, or user interaction is required — the vector is network-based against the site’s normal request handling.

The impact depends on server and theme pre-conditions being met, but where they are, this leads to remote code execution: the CVSS vector confirms full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), with attack complexity rated high (AC:H), reflecting that those pre-conditions aren’t guaranteed on every install.

This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 2026-09-25.

What to do

  • Check your WordPress Core version against the official WordPress advisory for CVE-2026-87902 and apply the fixed release once you’ve confirmed which version resolves it — a fixed version is not yet specified here, so consult the advisory directly for the exact build.
  • Audit active themes for any custom template-resolution code that relies on get_page_template() or similar path-building logic, as theme-specific pre-conditions affect exploitability.
  • Restrict filesystem permissions so that PHP files outside the active theme directory are not readable by the web server process where this isn’t already enforced — this narrows the pool of files an attacker could target for inclusion.
  • Given this is listed in CISA KEV, treat patching as time-sensitive rather than routine maintenance, and prioritise WordPress installations that are internet-facing.
  • Monitor web server and PHP error logs for unusual template-related file access or inclusion attempts referencing paths outside the theme directory as a low-cost detection measure while patching is scheduled.

For leadership 🧭

Executive summary. WordPress sites are exposed to a network-based flaw in core template handling that, under the right server and theme conditions, lets an attacker with no credentials run code on the site. It is already listed in CISA’s Known Exploited Vulnerabilities catalogue, so this needs treating as urgent rather than scheduled maintenance.

Why it matters:

  • The flaw sits in get_page_template(), a core WordPress function every site uses to pick which template renders a page, so exposure isn’t limited to a specific plugin or theme choice.
  • No authentication or user interaction is needed - the attack travels through normal page requests, meaning any internet-facing WordPress install is a potential target.
  • Where server and theme pre-conditions line up, the result is full remote code execution, giving an attacker complete control of confidentiality, integrity and availability on the host.
  • Inclusion of this CVE in CISA’s KEV catalogue since 25 September 2026 confirms it is being actively exploited in the wild, not just theoretically dangerous.

Now / Next / Later:

  • Now: Check web server and PHP logs for template-related file access or inclusion attempts pointing outside the active theme directory, and tighten filesystem permissions so PHP files outside that directory aren’t readable by the web server process.
  • Next: Consult the official WordPress advisory for CVE-2026-87902 to identify the fixed release for your version and apply it during the next available change window, prioritising any internet-facing installs.
  • Later: Audit active and custom themes for reliance on get_page_template() or similar path-resolution logic, and build routine checks for theme-specific pre-conditions into your WordPress update and hardening process.

Source