CVE-2026-87902

Exploited in the wild. In CISA KEV since 2026‑09‑25. Only a workaround so far.

CVSS 3.18.1High EPSS percentile86th2.9% chance in 30 days CISA KEVListedsince 2026-09-25, due 2026-09-28
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-09-22Updated 2026-09-26Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

Check your WordPress version and whether the latest security update for its release branch is installed.
If you run WordPress 7.1, update to 7.1.2; fixes were also backported to release branches as far back as 4.7.
If you cannot update immediately, ask your hosting provider or developer to apply the vendor mitigation and review the site for unexpected changes.

Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

In plain language

Written by AI from the record

WordPress has a serious flaw attackers are actively using; sites on releases from 4.7 onward need their available security update installed today.

Unauthenticated path manipulation in WordPress `get_page_template()` can include a readable local PHP file outside active theme directories and, when server and theme preconditions align, may lead to remote code execution.

If you're affected

Website takeover
Customer data exposure
Malicious code execution
Business disruption
Ransomware risk

What is it

This is a weakness in how WordPress chooses a page layout file. Under the right conditions, it can let an outsider point the site toward a file that should not be used, like tricking a receptionist into retrieving a document from the wrong filing cabinet. That can give an attacker a path to take control of the website.

Who is affected

This matters to you if you run a WordPress website, including one managed by a hosting provider or web developer. The issue is only a risk when the relevant server and active-theme conditions are present.

How urgent is it

Attackers are already exploiting this vulnerability in the real world. Treat this as an emergency update: CISA added it to its known-exploited list and set a remediation due date of September 28, 2026.

What to do — in detail

Confirm the installed WordPress version and identify the release branch used by each site, including separately managed or hosted instances. For the 7.1 branch, upgrade to 7.1.2; the fix was backported to all branches back to 4.7, so older branches should be updated to their latest vendor-provided security release rather than moved to 7.1 solely for this issue.

Review the active theme and server configuration because exploitation requires relevant preconditions in both. If patching is delayed, obtain and apply the vendor or hosting-provider mitigation, restrict unnecessary public access to the affected site where operationally feasible, and have the site reviewed for unexpected PHP files, altered themes, administrator accounts, or suspicious web-server activity.

CISA's KEV remediation due date is 2026-09-28. After remediation, monitor web-server and WordPress logs for unusual requests and investigate any evidence of unauthorized file or theme changes.

Technical context

CVE-2026-87902 is rated CVSS 8.1 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The weakness is CWE-98: an unauthenticated network attacker can influence get_page_template() resolution to include a chosen readable local .php file outside active theme directories. With the stated server and active-theme preconditions, this may become RCE. CISA KEV listing confirms real-world exploitation; the exploit finding provides a detection template only. EPSS was 2.9% at the 86th percentile with a flat trend, but confirmed exploitation takes precedence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS86th

CISA KEV

Listed as exploited in the wild since 2026-09-25.

US federal agencies must remediate by 2026-09-28.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.9% chance of exploitation activity in the next 30 days, which ranks it in the 86th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 4 days, from the signal feeds we watch.

2026-09-26Workaround availablerecord updated
2026-09-25Added to CISA KEVworkaround available, workaround available, record updated, record updated
2026-09-23Nuclei check added
2026-09-22Workaround availablepublished, weakness classified, record updated

Affected products

WordPressoss-project · USaka wp, wordpress.org, wordpress mu
- WordPressWeb AppOn-premWeb & CMS Plugins / cms-core

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-98No name in the record

Sources

References in the record

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for WordPress, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account