{"id":"CVE-2026-87902","published":"2026-09-22T17:17:28Z","modified":"2026-09-28T12:20:54Z","title":"WordPress Core Remote File Inclusion Vulnerability","vendor":"WordPress","product":"Core","tier":"core","eol":null,"description":{"text":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in WordPress Core's get_page_template() page-template resolution lets an attacker cause the software to include a chosen readable local .php file located outside the active theme directories. An unauthenticated remote attacker can trigger this without user interaction, and it can lead to remote code execution only if specific pre-conditions on both the server and the active theme are met.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:54:00Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.95769,"percentile":0.99872,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-09-25","dueDate":"2026-09-28","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-09-22","exploitedFirstSeen":"2026-09-22","ransomware":false,"evidence":[{"url":"https://patchstack.com/database/wordpress/plugin/wordpress/vulnerability/wordpress-core-7-1-1-unauthenticated-local-file-inclusion-to-remote-code-execution-vulnerability","date":"2026-09-22"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-711-unauthenticated-local-file-inclusion-via-locate-template-path-traversal#attacks-1m","date":"2026-09-22"},{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","date":"2026-09-23"},{"url":"https://previdian.com/CVE-2026-87902","date":"2026-09-23"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-09-25"},{"url":"https://x.com/ethicalhack3r/status/2102747373873004680","date":"2026-09-25"},{"url":"https://www.crowdsec.net/vulntracking-report/cve-2026-87902-wordpress-vulnerability","date":"2026-09-28"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":37,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-98","name":"Improper Control of Filename for Include/Require Statement in PHP Program"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","tags":["Vendor Advisory"]},{"url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated attacker exploits public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An unauthenticated attacker can make `get_page_template()`","start":0,"end":58}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Included PHP file enables remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"this can lead to RCE","start":243,"end":263}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-84555","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84555","exploited":true,"exploitedSince":"2026-09-23","provenance":"source"},"exploits":[{"id":52690,"url":"https://www.exploit-db.com/exploits/52690","title":"WordPress 7.0.2 - Path Travesal","type":"webapps","platform":"multiple","date":"2026-10-01","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-10-01"},"pocGithub":{"count":22,"skipped":3,"earliest":"2026-09-22","earliestUrl":"https://github.com/abraxas/CVE-2026-87902","repos":[{"name":"ressl/cve-2026-87902-poc","url":"https://github.com/ressl/cve-2026-87902-poc","stars":44,"created":"2026-09-22"},{"name":"abraxas/CVE-2026-87902","url":"https://github.com/abraxas/CVE-2026-87902","stars":35,"created":"2026-09-22"},{"name":"tc4dy/CVE-2026-87902-Toolkit","url":"https://github.com/tc4dy/CVE-2026-87902-Toolkit","stars":15,"created":"2026-09-23"},{"name":"dinosn/cve-2026-87902-wordpress-lfi-lab","url":"https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab","stars":13,"created":"2026-09-23"},{"name":"vulpecuna/CVE-2026-87902","url":"https://github.com/vulpecuna/CVE-2026-87902","stars":9,"created":"2026-09-22"}]},"nuclei":[{"id":"CVE-2026-87902","name":"WordPress Core - PHP Template Path Traversal","severity":"critical","path":"http/cves/2026/CVE-2026-87902.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml"}],"first":{"date":"2026-09-22","source":"PoC-in-GitHub","url":"https://github.com/abraxas/CVE-2026-87902"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-09-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902","provenance":"source"},{"date":"2026-09-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-10-01","url":"https://github.com/abraxas/CVE-2026-87902","provenance":"source"},{"date":"2026-09-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://patchstack.com/database/wordpress/plugin/wordpress/vulnerability/wordpress-core-7-1-1-unauthenticated-local-file-inclusion-to-remote-code-execution-vulnerability","provenance":"source"},{"date":"2026-09-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84555","provenance":"source"},{"date":"2026-09-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":3},"priority":{"score":78.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 39 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 22 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"37 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}