CVE-2026-87902

WordPress core's page-template resolution in get_page_template() contains an unauthenticated local file inclusion flaw (CWE-98): a remote attacker with no account can influence which template file WordPress includes, causing it to load a chosen readable local .php file from outside the active theme directories. If certain pre-conditions hold on both the server and the active theme — most notably the existence of an attacker-readable .php file on disk, such as content in an uploads directory — the included file's code executes, escalating the LFI to full remote code execution over the site (CVSS 8.1, high impact to confidentiality, integrity, and availability). The high attack-complexity rating reflects these pre-conditions, but successful exploitation requires no privileges and no user interaction. All sites running WordPress core versions prior to the 7.1.2 security release are affected and should treat this as a priority patch. The issue is fixed in WordPress 7.1.2; there is no public proof of concept, it is not in the CISA KEV catalog, and no exploitation in the wild is currently known.

What to do: Update to WordPress 7.1.2 immediately via Dashboard → Updates (or WP-CLI), and enable automatic updates for security releases so future fixes land without delay. As defense-in-depth against the LFI-to-RCE path, block PHP execution in wp-content/uploads and any other web-writable directories at the web-server level, since RCE depends on including a readable .php file. Afterwards, audit uploads and web logs for unexpected .php files and anomalous template-selection requests.