CVE-2026-87902 — Vulnerability intelligence

WordPress — Core

Published: 2026-09-22T16:44:15.048Z

CVSS

8.1

CISA KEV

Known exploitation

Original source text (not a translation)

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

Sources

• WordPress Core Remote File Inclusion Vulnerability
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-87902