Skip to content
Fencer Vulns
high 8.1

CVE-2026-87902 kev in the critical feed json

Unauthenticated path traversal in page-template resolution leading to conditional RCE

published 2026-09-22 47 d ago modified 2026-11-06 2 d ago also BIT-wordpress-2026-87902 , BIT-wordpress-multisite-2026-87902 , EUVD-2026-84555 , GHSA-7hp8-65ch-5whp

cvss
8.1
version 3.1, CNA
cisa kev
Exploited
added 2026-09-25
epss
95.8%
EPSS 95.8% chance of exploitation in 30 days, percentile 99.8%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • bitnami wordpress 7.1.2
  • bitnami wordpress-multisite 7.1.2
  • WordPress WordPress 7.1.2
  • wordpress Debian 13 6.8.10+dfsg1-0+deb13u1
  • wordpress Debian 14 7.1.2+dfsg1-1

debian advisories DEBIAN-CVE-2026-87902

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-87902 updated cvss 8.1

wordpress: WordPress: Remote code execution via page template resolution vulnerability

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. Added to CISA KEV
  4. CISA patch deadline
  5. First public exploit (EDB-52690)

Known exploited

Added
45 d ago
Patch by
2026-09-28 (42 d ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
WordPress, Core
CISA name
WordPress Core Remote File Inclusion Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
45 d ago

Exploit prediction

95.77% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52690 WordPress 7.0.2 - Path Travesal webapps, 2026-10-01
  • Nuclei template WordPress Core - PHP Template Path Traversal nuclei detection template

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami wordpress
<7.1.2
7.1.2
bitnami wordpress-multisite
<7.1.2
7.1.2

Affected products

  • WordPress WordPress

Classification

Weakness
  • CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of WordPress/wordpress-develop published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.