CVE-2026-87902

WordPress Core

Parchea ya: se está explotando

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

En las noticias

• Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure · The Hacker News
• Inclusión de archivos PHP en WordPress · INCIBE-CERT