CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
1 advisories matched
2026-09-22
WordPress Core get_page_template() Local File Inclusion (LFI) and Remote Code Execution (RCE) (CVE-2026-87902)
[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.
[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.
[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.