{"id":"CVE-2026-87902","details":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","aliases":["BIT-wordpress-2026-87902","BIT-wordpress-multisite-2026-87902","GHSA-7hp8-65ch-5whp"],"modified":"2026-11-08T02:47:43.902529266Z","published":"2026-09-22T16:44:15.048Z","database_specific":{"cna_assigner":"hackerone","cwe_ids":["CWE-98"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87902.json"},"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87902.json"},{"type":"ADVISORY","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902"},{"type":"ADVISORY","url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wordpress/wordpress","events":[{"introduced":"0"},{"fixed":"4b974c61ba56d7aab9e5aa928f921bb295d16965"},{"introduced":"06fa4161aa74619239cf27017d124081c825684a"},{"fixed":"d2107d8b699e5d3aec792cf4c50907d6288f4fc7"},{"introduced":"29ffbff370968ae48a1b7a34e35c8b8e75cf0f91"},{"fixed":"fe927b80c905197d02f55b0be4579864c89ebe17"},{"introduced":"491c67be12ca8a9fe37ae38307ba7e298c976ec3"},{"fixed":"bf829a2c84a789f026dcf2031d4d9563960fdb9a"},{"introduced":"c33464a4554cff8a082bc353d9226d8104b80d2b"},{"fixed":"bf8851400a9595ccb55e64dcc6be9cf37abe28e1"},{"introduced":"6fe64752be3260f2a47f38e68c2cb77400e5a0c9"},{"fixed":"4bc39aee09934e421bf2423eb23bff74a55b09a1"},{"introduced":"50dc0ca5bb332c895f0f39fe4e6ee1e4a43e06dc"},{"fixed":"c1b28183d0e6030d4759d68cb80432dcdf36809d"},{"introduced":"9ff4499281663b0c772787fd4a60538288f842e9"},{"fixed":"79580a19dc0de5b5be7ce659cd5a5703d2b3c881"},{"introduced":"537fd931bc02e6e934a2d774422b897871aa87ad"},{"fixed":"a0e82957c576e965f7af722d81ac26166e2df194"},{"introduced":"965fcddcf68cf4fd122ae24b992e242dfea1d773"},{"fixed":"032bc6e9accc94320f97902b44b5f17cc4c78d5d"},{"introduced":"058f9903676a7efaee534a682df0a2a8b87574d8"},{"fixed":"5aa4a8330fdc5961585b66bca4c2fa4975b086ad"},{"introduced":"50caeb6e61ad0c49d2c7e1d6d5115047a011f590"},{"fixed":"dc1be93bc16459a1a8fcfa1338b8291c7e3e1160"},{"introduced":"73157386d069425c5e6ea7c4fc0122e8a9b58a7b"},{"fixed":"96bc7ee1f43709f40711fc9395c0f3c2e511b19f"},{"introduced":"cc101b64012b16d087780657a2b828ccd7794a63"},{"fixed":"78612591f8c9dca7514fcaf0df48d54531c3ed7f"},{"introduced":"6c5d5b5dcb9712bfc400b09cb6627e42898527af"},{"fixed":"7dd9afe0a6769d0a5b1384cc3460fd4b7bdabffa"},{"introduced":"17e2eff4aa3beb2802cbec12b6f08e2fbf69893d"},{"fixed":"a3fdd1f57a6e0a9a760234efa386b2c4418a4007"},{"introduced":"ac3899153a790a6f060dc816ff94812e0fd99875"},{"fixed":"f96604eb17bb4aa7ab0680374df8efa6a2d3fe52"},{"introduced":"e2d61d78ede843c2d05f44a4e15f30a57fb47d95"},{"fixed":"cdc89a7cde831b0f1f1a6d86604eb509c1658152"},{"introduced":"e75a577410e912e1408c49ace9103c3ee9997d76"},{"fixed":"25815a9f89a15bc3c1e2c3930f16b8a33023de23"},{"introduced":"b9bdf794320b132e6a4ce1538e988e6d31be33b0"},{"fixed":"63f40acfe3ae391172c8ab6af1209f41a605bedb"},{"introduced":"7766f0a793653329067bd50874872cc363af4461"},{"fixed":"4e8671406b8dd91d1883e3d244cbf7cc11e41944"},{"introduced":"6ba3d560fc2b033654f6dbfc6093fefb5c50f148"},{"fixed":"6e6fa053d0c3e8b8ba34d2b51edde9da699b3d91"},{"introduced":"ec24ee6087dad52052c7d8a11d50c24c9ba89a3b"},{"fixed":"d393902c3f38df7bdec27236e5dcb049d0e321e0"},{"introduced":"b16cd68ea199838d8f9daf0ff7e3f35042ba0ad0"},{"fixed":"7fde92a30f5d457ff91a91351769319194466f1b"},{"introduced":"b998fef9238af183f9523b3df71618e6e57498b6"},{"fixed":"160387b7312c9407c7fe4b1d3dd2055206749a34"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"4.7.37"}]},{"range":[{"introduced":"4.8"},{"fixed":"4.8.32"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"4.9"},{"fixed":"4.9.33"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.0"},{"fixed":"5.0.29"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.1"},{"fixed":"5.1.26"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.2"},{"fixed":"5.2.28"}]},{"range":[{"introduced":"5.3"},{"fixed":"5.3.25"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.4"},{"fixed":"5.4.23"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.5"},{"fixed":"5.5.22"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.6"},{"fixed":"5.6.21"}]},{"range":[{"introduced":"5.7"},{"fixed":"5.7.19"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.8"},{"fixed":"5.8.17"}]},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.9"},{"fixed":"5.9.18"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.0"},{"fixed":"6.0.16"}]},{"range":[{"introduced":"6.1"},{"fixed":"6.1.14"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.2"},{"fixed":"6.2.13"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.3"},{"fixed":"6.3.12"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.4"},{"fixed":"6.4.12"}],"source":"CPE_RANGE"},{"range":[{"introduced":"6.5"},{"fixed":"6.5.12"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.6"},{"fixed":"6.6.9"}]},{"range":[{"introduced":"6.7"},{"fixed":"6.7.9"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"6.8"},{"fixed":"6.8.10"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.9"},{"fixed":"6.9.9"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"7.0"},{"fixed":"7.0.6"}]},{"range":[{"introduced":"7.1"},{"fixed":"7.1.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"}]}},{"type":"GIT","repo":"https://github.com/wordpress/wordpress-develop","events":[{"introduced":"0"},{"fixed":"1f10f081fca544747aa0821291f0f5e83036cfb0"},{"introduced":"2ac9b801ef5c18accf223b093529dacfcf809133"},{"fixed":"160ccf9264c676f786454d704ce1864288ad70cc"},{"introduced":"31f7ece8503f0dc6ef1df2473ae3f3d352973e12"},{"fixed":"cbf4802135d0adddfa1dc3119d1dd510cb5531c8"},{"introduced":"b3bf6266acd61682bc654845f621b4426645e324"},{"fixed":"7e8f9088e01098cc7c4af090c1293f02127be685"},{"introduced":"5aa596fee9bf6ea7f0ccc2ed51b16c0f2f04076b"},{"fixed":"59f1e40c2998cf5bc5a69f5eb7fcc91d0bb804ac"},{"introduced":"1cf3888655c0eb8b0b0539834ad67db5920190d7"},{"fixed":"d02ba3eb14be2a292cf8a7cd3c744b9a103f4629"},{"introduced":"d05f0a86b23e37b9d97acd9317ff3fd661d64dea"},{"fixed":"4adf50f96257c3de7fd1461aacdd18d8bca85afb"},{"introduced":"e0bedd676512ace4c5586337c072037298315f79"},{"fixed":"8af9754d4ca343429f42a3333dd4ea73974bb2f8"},{"introduced":"944a787b8071d3a27f4ac68980c21ed6137db91d"},{"fixed":"92a8ddabe6221c8129a5e6aed3999bacb02993a1"},{"introduced":"96a6969aab5f0b9362cbc984af230bdfc93022e8"},{"fixed":"adc01e3a1f295623711c33baccb36cc9942dc97c"},{"introduced":"895d6a691d7ccdfe80cdf999bc0c8a78d11ad55a"},{"fixed":"c18b92b9203e158243e77d75e925e2a4f2792f0f"},{"introduced":"4b54a6c2c9a3be775cc6dda66ed207998b068c8f"},{"fixed":"8681f271b7780d8f90c04b8ab75a370389017db0"},{"introduced":"b83a8be65054cd890e24c7c1416ebbb39aeb4c09"},{"fixed":"b5fbaef7ac4d33fba475d2b76c2100386595364b"},{"introduced":"1c0a2efa5eac05dfd3b7d2b9cfe68e02da55b966"},{"fixed":"645b8112e05707a6f57b287fcb5c94128dc3af7b"},{"introduced":"e33c9f3203961a823ec8410fc1481f6c87b4e3db"},{"fixed":"b0554a93e60e7780ecc65ddf11493e531c26d7eb"},{"introduced":"b829903bb0104bfeccc7623946a25cb7ccda1dea"},{"fixed":"3e52d0f74320d236cdf0147ea85741f7ebb5e090"},{"introduced":"4a6363076129378869f8742ef00a39a7421e6f29"},{"fixed":"d532f18d63e4782cad3f72526999e431a689158f"},{"introduced":"82dab16707a0a9af6a9707fed979a559aefdd511"},{"fixed":"f57936455ed4e22e85bcf491250d26b5b7446522"},{"introduced":"720804c22f867fe56332ab513428e945c24b889d"},{"fixed":"af10567c99596a570a2d35e29c17280ad1e1fde9"},{"introduced":"4115c99a784db8a787e2245300c83c9c8d336503"},{"fixed":"f24c1235372807013c2ce032a3b536c072d7d41a"},{"introduced":"262f4b6add2d1503bdd35611764ec58742b10fb9"},{"fixed":"38fbfea21e62ed083d7d7a384c515fda220101cc"},{"introduced":"a33a49e2e7f7e47656bc835996c692593edeba00"},{"fixed":"a62d18131a90b23ec55a21e24702abc5a24eee29"},{"introduced":"3a87241015aff96c7a38c1304949908b9588b218"},{"fixed":"8491a9be893ce6e451afcda71bc9c76ae0f85a60"},{"introduced":"26b68024931348d267b70e2a29910e1320d0094f"},{"fixed":"ec455a506d511d8d233ae4ba158f1163c13dd888"},{"introduced":"daaca56d3d6a9a42a0c87f6eda766c33a77c1d05"},{"fixed":"0a106cde38df869e196a83eb4975ba38a4e5837b"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"4.7.37"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"4.8"},{"fixed":"4.8.32"}]},{"range":[{"introduced":"4.9"},{"fixed":"4.9.33"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.0"},{"fixed":"5.0.29"}]},{"range":[{"introduced":"5.1"},{"fixed":"5.1.26"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.2"},{"fixed":"5.2.28"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.3"},{"fixed":"5.3.25"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.4"},{"fixed":"5.4.23"}]},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.5"},{"fixed":"5.5.22"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.6"},{"fixed":"5.6.21"}]},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.7"},{"fixed":"5.7.19"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.8"},{"fixed":"5.8.17"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"5.9"},{"fixed":"5.9.18"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.0"},{"fixed":"6.0.16"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.1"},{"fixed":"6.1.14"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.2"},{"fixed":"6.2.13"}]},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.3"},{"fixed":"6.3.12"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.4"},{"fixed":"6.4.12"}]},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.5"},{"fixed":"6.5.12"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.6"},{"fixed":"6.6.9"}]},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.7"},{"fixed":"6.7.9"}],"source":"CPE_RANGE"},{"range":[{"introduced":"6.8"},{"fixed":"6.8.10"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"6.9"},{"fixed":"6.9.9"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"7.0"},{"fixed":"7.0.6"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","range":[{"introduced":"7.1"},{"fixed":"7.1.2"}]}]}}],"versions":["4.9.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87902.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}