WordPress Core Remote File Inclusion (CVE-2026-87902)

Catalog analysis: CISA added this entry on September 25, 2026. The entry reflects catalog information retrieved on September 26, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-87902 is a Remote File Inclusion (RFI) vulnerability identified in WordPress Core. The flaw exists within the page-template resolution process. An unauthenticated attacker could exploit this to force the system to include a readable local .php file located outside of the active theme directories. This mechanism can be leveraged to achieve remote code execution (RCE) on the affected server.

Exposure and applicability

This vulnerability affects installations of WordPress Core. The primary exposure path is via unauthenticated requests that manipulate how the application resolves page templates. Because this does not require prior authentication, any internet-facing WordPress instance using a vulnerable version of the core software is at risk. Organizations managing multiple WordPress sites or those utilizing managed hosting environments should verify if their specific deployment is susceptible to this template resolution flaw.

Remediation priorities

Our analysis suggests prioritizing remediation based on the asset’s exposure level and the sensitivity of the data hosted on the server.

1. Immediate Patching: The primary corrective action is to apply mitigations according to vendor instructions. This should be prioritized for all public-facing instances.
2. Forensic Triage: Because this vulnerability allows for RCE, we recommend performing forensic triage on high-value assets to determine if the flaw was exploited prior to patching.
3. Exposure Reduction: For environments where immediate patching is delayed, restricting access to the WordPress administrative and template resolution interfaces via network-level controls could reduce the likelihood of exploitation.

How to validate remediation

Verification must go beyond confirming a version number change. To ensure exposure has been reduced, defenders should:

• Verify Patch Application: Confirm that the vendor-supplied security update is active across all nodes in a load-balanced environment.
• Test Template Resolution: In a staged environment, attempt to trigger page-template resolution using paths outside the active theme directory to confirm the inclusion is now blocked.
• Audit File Permissions: Review local .php file permissions to ensure that sensitive files are not globally readable, which could limit the impact of similar RFI attempts.

Limits and open questions

While patching addresses the known flaw in page-template resolution, residual risk remains if other vulnerabilities allow for the placement of malicious .php files on the local filesystem. It is currently unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while vendor mitigations address the core logic, the effectiveness of these fixes may vary depending on specific server configurations or custom theme implementations that override standard template resolution.

Source and editorial note

CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability · Source date: September 25, 2026 · Retrieved September 26, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment