WordPress Core get_page_template() Local File Inclusion (LFI) and Remote Code Execution (RCE) (CVE-2026-87902)

Affected Vendors

WordPress

Affected Components

WordPress Core

Published Date

2026-09-22

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All WordPress installations running vulnerable core versions and specific themes.

Impact

Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.

Mitigation

Immediate update to the latest WordPress security release and deployment of WAF filtering rules.

Affected Products & Version Scope

All WordPress sites using vulnerable versions of the core software are at high risk, especially those with publicly accessible upload directories or verbose logging.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Update WordPress: Apply the latest security patches immediately via the dashboard or CLI.

bash

wp core update

WAF Configuration: Implement rules to detect and block directory traversal sequences (../) in URL parameters related to page templates.
Hardening: Restrict file system permissions and disable PHP execution in the /wp-content/uploads/ directory using .htaccess or Nginx configuration.

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Apply the official WordPress security patch immediately and monitor for suspicious template resolution requests in access logs.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

The vulnerability stems from an improper path resolution logic within the get_page_template() function. An unauthenticated attacker can manipulate template resolution to include arbitrary .php files located outside the active theme's directory (CWE-98). If the attacker can influence the content of any local PHP file (e.g., via log poisoning or media uploads), this LFI can be escalated to Remote Code Execution (RCE). With an EPSS score of 0.94 and inclusion in the CISA KEV catalog, this flaw is being actively exploited in the wild.

Official Vendor Advisories & References

NVD Original English Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

Source: support@hackerone.com · Vendor Advisory

https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: