High severity8.1NVD Advisory· Published Sep 22, 2026
CVE-2026-87902
CVE-2026-87902
Description
An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1News mentions
2- WordPress 7.1.2 Security Release: Unauthenticated LFI to RCEPatchstack Blog · Sep 22, 2026
- WordPress 7.1.2 ReleaseWordPress Core Security · Sep 22, 2026