HIGH 8.1 NVD

CVE-2026-87902

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directo

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

Published: 2026-09-22 · Source: NVD · Feed updated: 2026-09-22

This high severity vulnerability with a CVSS score of 8.1 was published on 2026-09-22 via NVD.

vulnfeed aggregates 13417 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.