CVE-2026-87902

WordPress Core

Patch now: it is being exploited

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

In the news

• Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure · The Hacker News
• Inclusión de archivos PHP en WordPress · INCIBE-CERT