/Vulnerability Library

WordPress Core - PHP Template Path Traversal

CVE-2026-87902
Early Release

Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Severity

Critical

CVSS Score

9.2

Exploit Probability

20%

Affected Product

wordpress

Published Date

September 22, 2026

Template Author

hadrian, flx

CVE-2026-87902.yaml
9.2Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE ID:
cve-2026-87902
CWE ID:
cwe-98

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whphttps://github.com/WordPress/WordPress/commit/fdeab470f4b4062462cf8ccdc788f258683c2d6fhttps://hadrian.io/vulnerability-alerts/cve-2026-87902-working-poc-wordpress-critical-path-traversal

Remediation Steps

Update WordPress to a patched maintenance release for the installed branch.