November 14, 2026

CVE Watchtower

CVE-2026-87902Wordpress Wordpress

NVDCVSS scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vulnerability Summary

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Severity Level
HIGH(8.1)
Published Date
Sep 22, 2026
Last Modified
Sep 28, 2026
PoC
Available(Nuclei)
Exploitation Status
ACTIVE
EPSS Score (30-Day)
95.77%Probability
Root Weakness (CWE)
CWE-98 ↗
See the MITRE CWE entry for the full definition of this weakness.
CVSS v3.1 Base Metrics — Score 8.1 (HIGH)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Wordpress Wordpress < 4.7.37
  • Wordpress Wordpress >= 4.8 and < 4.8.32
  • Wordpress Wordpress >= 4.9 and < 4.9.33
  • Wordpress Wordpress >= 5.0 and < 5.0.29
  • Wordpress Wordpress >= 5.1 and < 5.1.26
  • Wordpress Wordpress >= 5.2 and < 5.2.28
  • Wordpress Wordpress >= 5.3 and < 5.3.25
  • Wordpress Wordpress >= 5.4 and < 5.4.23
  • Wordpress Wordpress >= 5.5 and < 5.5.22
  • Wordpress Wordpress >= 5.6 and < 5.6.21
  • Wordpress Wordpress >= 5.7 and < 5.7.19
  • Wordpress Wordpress >= 5.8 and < 5.8.17
  • Wordpress Wordpress >= 5.9 and < 5.9.18
  • Wordpress Wordpress >= 6.0 and < 6.0.16
  • Wordpress Wordpress >= 6.1 and < 6.1.14
  • Wordpress Wordpress >= 6.2 and < 6.2.13
  • Wordpress Wordpress >= 6.3 and < 6.3.12
  • Wordpress Wordpress >= 6.4 and < 6.4.12
  • Wordpress Wordpress >= 6.5 and < 6.5.12
  • Wordpress Wordpress >= 6.6 and < 6.6.9
  • Wordpress Wordpress >= 6.7 and < 6.7.9
  • Wordpress Wordpress >= 6.8 and < 6.8.10
  • Wordpress Wordpress >= 6.9 and < 6.9.9
  • Wordpress Wordpress >= 7.0 and < 7.0.6
  • Wordpress Wordpress >= 7.1 and < 7.1.2
Patched Versions
  • Wordpress Wordpress 4.7.37
  • Wordpress Wordpress 4.8.32
  • Wordpress Wordpress 4.9.33
  • Wordpress Wordpress 5.0.29
  • Wordpress Wordpress 5.1.26
  • Wordpress Wordpress 5.2.28
  • Wordpress Wordpress 5.3.25
  • Wordpress Wordpress 5.4.23
  • Wordpress Wordpress 5.5.22
  • Wordpress Wordpress 5.6.21
  • Wordpress Wordpress 5.7.19
  • Wordpress Wordpress 5.8.17
  • Wordpress Wordpress 5.9.18
  • Wordpress Wordpress 6.0.16
  • Wordpress Wordpress 6.1.14
  • Wordpress Wordpress 6.2.13
  • Wordpress Wordpress 6.3.12
  • Wordpress Wordpress 6.4.12
  • Wordpress Wordpress 6.5.12
  • Wordpress Wordpress 6.6.9
  • Wordpress Wordpress 6.7.9
  • Wordpress Wordpress 6.8.10
  • Wordpress Wordpress 6.9.9
  • Wordpress Wordpress 7.0.6
  • Wordpress Wordpress 7.1.2

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Sep 28, 2026.

  1. Check whether you run Wordpress Wordpress and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Sep 25, 2026
Remediation due: Sep 28, 2026 (deadline passed)

Timeline

  • Sep 22, 2026Published
  • Sep 25, 2026Added to CISA KEV catalog
  • Sep 28, 2026KEV remediation due date
  • Sep 28, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Wordpress Wordpress CVEsYou are reading CVE-2026-87902. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

Related Coverage

More Wordpress Wordpress CVEs

External References

Data last checked: Nov 14, 2026 16:07 UTC