{"id":"wordpress-core-file-inclusion-cve-2026-87902-sep","category":"patch","status":"closed","title":"WordPress Core file inclusion flaw CVE-2026-87902 exploited; update to 7.1.2 or your branch's fix","tldr":"WordPress flaw CVE-2026-87902 lets anyone without a login make a site load a chosen PHP file, and can lead to code execution. CISA lists it as exploited. Fixed in 7.1.2 and backports to 4.7. Update WordPress, or ask your web host or developer to.","summary":"CVE-2026-87902 is a flaw in how WordPress Core chooses a page template. An attacker with no account can make a site load a readable PHP file from elsewhere on the server. WordPress published the advisory on 22 September 2026 and released fixed versions the same day, including 7.1.2, 7.0.6 and 6.9.9, with fixes backported to every branch back to 4.7. Every version from 4.7.0 to 7.1.1 is affected. Turning file inclusion into code execution needs two conditions: the active theme has a top-level folder whose name starts with 'page-' (named examples include Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney), and PHP is running with register_argc_argv on, which is the default in the official PHP Docker image and in common cPanel setups before PHP 8.5. CISA listed the flaw as exploited on 25 September 2026. An early report on 23 September had seen no attacks, so the attacks were reported after that. The vendor rates it 9.2 (CVSS v4); CISA's entry says 8.1. Details of the attacks have not been published in the sources read.","action":"Update WordPress to 7.1.2, or the fixed release for your branch (for example 7.0.6 or 6.9.9), from the Dashboard under Updates. If someone else runs your site, ask your web host or developer to confirm it has been updated.","product":"WordPress Core (4.7.0 to 7.1.1)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-87902"],"tags":["wordpress","cms","web-server","php","file-inclusion","remote-code-execution","cisa-kev","exploited"],"affected":["WordPress 4.7.0 through 7.1.1, across all branches (7.1.0–7.1.1, 7.0.0–7.0.5, 6.9.0–6.9.8, 6.8.0–6.8.9, and older branches back to 4.7.0–4.7.36)"],"fixed":["7.1.2","7.0.6","6.9.9","6.8.10","6.7.9","6.6.9","6.5.12","6.4.12","6.3.12","6.2.13","6.1.14","6.0.16","5.9.18","4.9.33","4.7.37"],"matches":[],"sources":[{"kind":"advisory","title":"Unauthenticated path traversal in page-template resolution leading to conditional RCE (GHSA-7hp8-65ch-5whp)","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","by":"WordPress","date":"2026-09-22"},{"kind":"news","title":"CVE-2026-87902: how close is your WordPress to remote code execution?","url":"https://securityaffairs.com/199564/hacking/cve-2026-87902-how-close-is-your-wordpress-to-remote-code-execution.html","by":"Security Affairs","date":"2026-09-23"}],"started":"2026-09-22","closed":"2026-09-25","created":"2026-11-03T21:42:33.632Z","updated":"2026-11-03T21:42:33.632Z","cve_notes":[{"cve":"CVE-2026-87902","name":"File inclusion in WordPress page-template lookup","what":"A path flaw in WordPress's page-template lookup lets an unauthenticated attacker make a site include a chosen readable local PHP file outside the theme folders, which can lead to running the attacker's code when the site's theme and PHP settings allow it.","severity":"critical","cvss":9.2}],"timeline":[{"at":"2026-09-25","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA listed CVE-2026-87902 among flaws being used in attacks, rating it CVSS 8.1 (the vendor advisory scores it 9.2 on CVSS v4).","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","by":"CISA","patch":null},{"at":"2026-09-23","added":"2026-11-03T21:41:32.717Z","kind":"other","text":"Security Affairs explained the flaw: any affected site can be made to include a local PHP file without login, and code execution needs a theme folder starting with 'page-' plus PHP's register_argc_argv setting. It reported no in-the-wild exploitation at that time.","url":"https://securityaffairs.com/199564/hacking/cve-2026-87902-how-close-is-your-wordpress-to-remote-code-execution.html","by":"Security Affairs","patch":null},{"at":"2026-09-22","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"WordPress published an advisory for CVE-2026-87902 and released fixes, including 7.1.2, 7.0.6 and 6.9.9, backported to every branch back to 4.7. Robert Ressl reported the flaw.","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","by":"WordPress","patch":"patched"}],"url":"https://hard.fyi/live/wordpress-core-file-inclusion-cve-2026-87902-sep/","json":"https://hard.fyi/api/live?id=wordpress-core-file-inclusion-cve-2026-87902-sep"}