CVE-2026-87902: how close is your WordPress to remote code execution?

WordPress 7.

• 2 fixes an unauthenticated file inclusion bug active since version 4. 7, patchable but exploitable into remote code execution.

WordPress 7.

• 2 shipped on September 22 address an unauthenticated local file inclusion, tracked as CVE-2026-87902 (CVSS score of 9. 2), which stems of how the CMS resolves page templates, with a real path to remote code execution.

The bugs affected every version back to 4.

• 0. That’s nearly a decade of releases, and nobody needs an account to trigger it. Robert Ressl gets credit for reporting it.

The flaw resides in get_page_template() , the function WordPress uses to choose which template should load a page. WordPress creates a list of possible template filenames, and one of them comes directly from the pagename value in the URL without any proper validation.

The problem becomes clearer when you look at the code around it.