Critical WordPress vulnerability CVE-2026-87902
The most recent WordPress versions have disclosed the critical vulnerability CVE-2026-87902 with a CVSS score of 9.2. It allows unauthenticated attackers to read .php files outside of active theme directories in the process of determining page templates via the get_page_template() function. A Proof of Concept (PoC) is publicly available, so it is expected to be actively exploited in attacks.
Under certain conditions, exploiting this vulnerability allows for remote code execution on the server. These conditions are related to the theme structures and files available on the server.
Necessary actions:
- Update WordPress to version 7.1.2, or another version (fixes are also available in older versions up to 4.7) where this vulnerability is fixed.
Affected versions:
- 7.1.0 - 7.1.1, fixed in version 7.1.2
- 7.0.0 - 7.0.5, fixed in version 7.0.6
- 6.9.0 - 6.9.8, fixed in version 6.9.9
- 6.8.0 - 6.8.9, fixed in version 6.8.10
- 6.7.0 - 6.7.8, fixed in version 6.7.9
- 6.6.0 - 6.6.8, fixed in version 6.6.9
- 6.5.0 - 6.5.11, fixed in version 6.5.12
- 6.4.0 - 6.4.11, fixed in version 6.4.12
- 6.3.0 - 6.3.11, fixed in version 6.3.12
- 6.2.0 - 6.2.12, fixed in version 6.2.13
- 6.1.0 - 6.1.13, fixed in version 6.1.14
- 6.0.0 - 6.0.15, fixed in version 6.0.16
- 5.9.0 - 5.9.17, fixed in version 5.9.18
- 5.8.0 - 5.8.16, fixed in version 5.8.17
- 5.7.0 - 5.7.18, fixed in version 5.7.19
- 5.6.0 - 5.6.20, fixed in version 5.6.21
- 5.5.0 - 5.5.21, fixed in version 5.5.22
- 5.4.0 - 5.4.22, fixed in version 5.4.23
- 5.3.0 - 5.3.24, fixed in version 5.3.25
- 5.2.0 - 5.2.27, fixed in version 5.2.28
- 5.1.0 - 5.1.25, fixed in version 5.1.26
- 5.0.0 - 5.0.28, fixed in version 5.0.29
- 4.9.0 - 4.9.32, fixed in version 4.9.33
- 4.8.0 - 4.8.31, fixed in version 4.8.32
- 4.7.0 - 4.7.36, fixed in version 4.7.37
Additional information from the developer:
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp