CVE-2026-87902: WordPress RCE Vulnerability via Page Template Resolution
Summary
CVE-2026-87902: An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. Affects wordpress across 25 version ranges.
< 4.7.37
>= 4.8.0, < 4.8.32
>= 4.9.0, < 4.9.33
>= 5.0.0, < 5.0.29
>= 5.1.0, < 5.1.26
>= 5.2.0, < 5.2.28
>= 5.3.0, < 5.3.25
>= 5.4.0, < 5.4.23
>= 5.5.0, < 5.5.22
>= 5.6.0, < 5.6.21
>= 5.7.0, < 5.7.19
>= 5.8.0, < 5.8.17
>= 5.9.0, < 5.9.18
>= 6.0.0, < 6.0.16
>= 6.1.0, < 6.1.14
>= 6.2.0, < 6.2.13
>= 6.3.0, < 6.3.12
>= 6.4.0, < 6.4.12
>= 6.5.0, < 6.5.12
>= 6.6.0, < 6.6.9
>= 6.7.0, < 6.7.9
>= 6.8.0, < 6.8.10
>= 6.9.0, < 6.9.9
>= 7.0.0, < 7.0.6
>= 7.1.0, < 7.1.2
Fixed in 25 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- wordpress-multisite · Bitnami
The same CVE-2026-87902 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It features a plugin architecture and a template system, enabling users to customize their sites extensively. However, certain vulnerabilities can expose WordPress installations to security risks, such as remote code execution (RCE), which can compromise the integrity of the site and its data.
Vulnerability Detail
The vulnerability identified as CVE-2026-87902 allows an unauthenticated attacker to exploit the get_page_template() function, which is responsible for resolving page templates. If specific pre-conditions related to the server and active theme are met, this vulnerability can lead to the inclusion of a chosen readable local .php file outside the active theme directories. This could result in remote code execution, allowing attackers to execute arbitrary code on the server, potentially leading to data breaches or site defacement.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.7.374.7.37 -
>= 4.8.0, < 4.8.324.8.32 -
>= 4.9.0, < 4.9.334.9.33 -
>= 5.0.0, < 5.0.295.0.29 -
>= 5.1.0, < 5.1.265.1.26 -
>= 5.2.0, < 5.2.285.2.28
Show all 25 release lines
-
>= 5.3.0, < 5.3.255.3.25 -
>= 5.4.0, < 5.4.235.4.23 -
>= 5.5.0, < 5.5.225.5.22 -
>= 5.6.0, < 5.6.215.6.21 -
>= 5.7.0, < 5.7.195.7.19 -
>= 5.8.0, < 5.8.175.8.17 -
>= 5.9.0, < 5.9.185.9.18 -
>= 6.0.0, < 6.0.166.0.16 -
>= 6.1.0, < 6.1.146.1.14 -
>= 6.2.0, < 6.2.136.2.13 -
>= 6.3.0, < 6.3.126.3.12 -
>= 6.4.0, < 6.4.126.4.12 -
>= 6.5.0, < 6.5.126.5.12 -
>= 6.6.0, < 6.6.96.6.9 -
>= 6.7.0, < 6.7.96.7.9 -
>= 6.8.0, < 6.8.106.8.10 -
>= 6.9.0, < 6.9.96.9.9 -
>= 7.0.0, < 7.0.67.0.6 -
>= 7.1.0, < 7.1.27.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive files and directories on their server, ensuring that only authorized users can access them. Additionally, disabling the get_page_template() function or implementing strict input validation can help mitigate the risk until a proper update is applied.
Conclusion
CVE-2026-87902 is a significant vulnerability in WordPress that can lead to remote code execution if not addressed. Users are urged to update their installations to the latest patched versions and consider implementing workarounds to mitigate risks until updates can be applied. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time.
See every vulnerability recorded for wordpress →
FAQ
CVE-2026-87902 is a vulnerability in WordPress that allows unauthenticated attackers to exploit the get_page_template() function, potentially leading to remote code execution.
If your WordPress version is below the patched versions listed (4.7.37, 4.8.32, etc.), your site may be vulnerable. You can also use tools like Vulert to check for vulnerabilities.
If an immediate update is not possible, implement the suggested workarounds to restrict access to sensitive files and validate inputs to reduce the risk of exploitation.
You can update your WordPress installation through the admin dashboard by navigating to the updates section or by downloading the latest version from the official WordPress website.
Vulert monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by vulnerabilities without any signup using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
