Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE

CVE-2026-87902

8.1
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
wordpress
Updated Nov 10, 2026View on NVD →
S4E scanner

WordPress Core - PHP Template Path Traversal

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp https://github.com/WordPress/WordPress/commit/fdeab470f4b4062462cf8ccdc788f258683c2d6f https://hadrian.io/vulnerability-alerts/cve-2026-87902-working-poc-wordpress-critical-path-traversal Remediation: Update WordPress to a patched maintenance release for the installed branch.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

CVE history: wordpress

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →