CVE-2026-87902: how close is your WordPress to remote code execution?
Critical WordPress file inclusion flaw (CVE-2026-87902) allows RCE and has been present since version 4.7.0.
WordPress 7.1.2 addresses a critical (CVSS 9.2) unauthenticated file inclusion vulnerability, CVE-2026-87902, which has existed since version 4.7.0. The flaw in the `get_page_template()` function allows remote code execution under specific conditions, including a theme with a 'page-' folder and a PHP environment with `register_argc_argv` enabled. The patch not only closes the direct hole but also adds a new function, `_wp_is_template_path_allowed()`, for broader template path validation.
- WordPress 7.1.2 fixes a critical (CVSS 9.2) unauthenticated file inclusion bug, CVE-2026-87902.
- The flaw exists in the get_page_template() function and has been present since version 4.7.0 (2016).
- Exploitation requires a theme with a 'page-' folder and specific PHP settings (register_argc_argv enabled).
- The patch adds a broader template path validation function, suggesting a defense-in-depth approach.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- PatchStack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
3 min read at securityaffairs.com
WordPress 7. 1. 2 fixes an unauthenticated file inclusion bug active since version 4.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.