CVE-2026-87902: WordPress Core Page-Template Remote File Inclusion RCE (KEV)

CVE-2026-87902 is a remote file inclusion vulnerability in WordPress Core's page-template resolution that lets an unauthenticated attacker point at a readable local PHP file outside the theme directory, and it can lead to remote code execution when the active theme has a 'page-' prefixed top-level directory and a usable local PHP file exists on the server; CISA added it to KEV days after disclosure once scanning for it began.

CVE-2026-87902 is a remote file inclusion (CWE-98) vulnerability in WordPress Core. The official GitHub Security Advisory states that "an unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories," and that this "can lead to RCE" if the relevant preconditions on both the server and the active theme are met (WordPress Security Advisory GHSA-7hp8-65ch-5whp).

The advisory names two concrete preconditions: the active child or parent theme must contain a top-level directory whose name starts with page- (themes it lists as affected in this way include Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney), and a chosen local .php target file must exist on the server and be readable by the web-server account — for example pearcmd.php when it is present, as it is in Docker's official PHP image or default cPanel setups (WordPress Security Advisory GHSA-7hp8-65ch-5whp).

NVD lists this CVE with status "Analyzed" and a CVSS v3.1 base score of 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable and unauthenticated, but with high attack complexity reflecting the theme/file preconditions above (NVD).

The fix landed across every actively supported branch at once: WordPress Core before 4.7.37 and every minor line from 4.8 through 7.1 has a patched point release (full per-branch list in the affected-versions field above), with WordPress 7.1.2 as the current latest (WordPress Security Advisory GHSA-7hp8-65ch-5whp).

CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-25, three days after the advisory's publication, with a required-action due date of 2026-09-28 — security firm Patchstack has reported (third-party, not WordPress-confirmed) that it observed scanning activity targeting the flaw within hours of the patch going out (CISA KEV; Patchstack).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.95769 (99.871th percentile) — an unusually high score reflecting the scale of WordPress's install base and the speed of post-patch scanning (FIRST EPSS).

Sites should update WordPress Core to the patched release for their branch immediately; sites on a theme with a page- prefixed directory and any locally-reachable .php utility file (such as pearcmd.php under common Docker/cPanel PHP configurations) should treat this as actively exploited and check for signs of prior compromise.

• Unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories, which can lead to RCE given theme and server preconditions. — WordPress Security Advisory GHSA-7hp8-65ch-5whp
• CVSS v3.1 base score is 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, NVD status Analyzed. — NVD
• Preconditions: active theme has a top-level directory starting with 'page-' (e.g. Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney) and a readable local .php target file exists (e.g. pearcmd.php under Docker's official PHP image or default cPanel). Fixed across every branch 4.7.37 through 7.1.2. — WordPress Security Advisory GHSA-7hp8-65ch-5whp
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-25, due date 2026-09-28. — CISA KEV
• EPSS score is 0.95769 (99.871th percentile) as of 2026-10-27. — FIRST EPSS