CVE-2026-87902 in WordPress
Summary
by MITRE • 09/22/2026
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described involves a critical flaw in the WordPress core function get_page_template(), which is responsible for determining which template file should be used to render a specific page or post within the WordPress content management system. This function operates by searching through various directories, including theme folders and plugin paths, to locate an appropriate PHP template file that matches the requested resource. Under normal circumstances, this process ensures that themes can override default templates while maintaining security boundaries around where files are sourced from. However, due to insufficient input validation or path traversal logic errors within get_page_template(), it becomes possible for an unauthenticated attacker to manipulate the resolution mechanism so that instead of selecting a legitimate template file inside active theme directories, the function resolves and includes arbitrary local PHP files located outside those designated safe zones.
This behavior constitutes a Local File Inclusion (LFI) vulnerability as defined under CWE-98 Improper Control of Filename for Include/Require Statement in PHP Programs. The root cause lies in how user-supplied input or internal variables are processed without adequate sanitization before being used to construct file paths during template resolution. When combined with specific server configurations and theme setups that allow inclusion of external files, this flaw enables an attacker who does not need any form of authentication to inject references to maliciously crafted PHP scripts stored elsewhere on the filesystem accessible by the web server process.
The operational impact of exploiting this vulnerability is severe because it directly leads to Remote Code Execution (RCE). Once a chosen readable local .php file outside active theme directories gets included via get_page_template(), if that file contains executable code controlled or influenced by the attacker, they gain full control over what runs on the target system. This could result in complete compromise of the underlying server environment including access to sensitive data such as database credentials stored within wp-config.php, modification or deletion of website content, installation of backdoors for persistent access, and potentially further lateral movement across networked systems depending upon privileges granted to the web service account running PHP processes.
From a tactical perspective aligned with MITRE ATT&CK framework techniques this scenario maps closely toward T1059 Command and Scripting Interpreter specifically using components like php or similar scripting engines available on Linux/Unix based hosting environments commonly used for WordPress deployments Additionally it relates indirectly towards initial access vectors since successful exploitation allows attackers bypass traditional perimeter defenses relying solely on network-level protections rather than application layer controls designed prevent unauthorized code execution.
Mitigation strategies must address both immediate remediation steps as well long-term architectural improvements aimed preventing similar issues arising from improper handling dynamic file inclusion operations within CMS platforms like WordPress First priority should involve applying official patches released by development team addressing identified weakness ensuring all installations updated accordingly Secondly administrators ought review current theme configurations disabling features allowing unrestricted template overrides unless explicitly required thirdly implementing strict filesystem permissions restricting write access only necessary directories minimizing exposure surface area fourth deploying Web Application Firewall WAF rules capable detecting patterns associated with attempted file inclusion attacks providing additional layer protection fifth conducting regular audits reviewing codebase identifying potential weaknesses related to dynamic includes ensuring adherence secure coding practices outlined industry standards such as OWASP Top Ten Project especially focusing areas involving input validation output encoding path canonicalization finally considering adoption modern frameworks offering built safeguards against common web application vulnerabilities reducing reliance custom implementations prone errors inherent legacy systems lacking ongoing maintenance support