CVE-2026-87902
38Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.1
from disclosure to weapon0 days
Published on NVDSep 22
1st PoCSep 22
exploitation probability
—
observed exploitation
nono source reports it
4 public exploit(s)
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
WordPress · WordPresspublic PoCs found — 4
githubgithub.com/abraxas/CVE-2026-87902★ 10githubgithub.com/ressl/cve-2026-87902-poc★ 6githubgithub.com/vulpecuna/CVE-2026-87902★ 1githubgithub.com/griisemine/cve-2026-87902-detection★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.