Critical WordPress Core Flaw Lets Unauthenticated Attackers Execute Remote Code

WordPress has released version 7.

• 2 to address a critical core vulnerability that could allow unauthenticated attackers to achieve remote code execution under specific server and theme configurations.

Tracked as CVE-2026-87902 and GHSA-7hp8-65ch-5whp, the flaw carries a CVSS v4 score of 9. 2 and affects WordPress installations dating back to version 4.

• The issue resides in WordPress page-template resolution, specifically within the get_page_template() functionality. An attacker does not need a WordPress account or any privileges to exploit the flaw.

Critical WordPress Core Flaw

By manipulating page-template handling, they may be able to cause WordPress to include a readable local PHP file located outside the active theme directory.