CVE-2026-87902
EUVD-2026-8455522.09.2026, 17:17
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| wordpress | wordpress | 𝑥 < 4.7.37 |
| wordpress | wordpress | 4.8 ≤ 𝑥 < 4.8.32 |
| wordpress | wordpress | 4.9 ≤ 𝑥 < 4.9.33 |
| wordpress | wordpress | 5.0 ≤ 𝑥 < 5.0.29 |
| wordpress | wordpress | 5.1 ≤ 𝑥 < 5.1.26 |
| wordpress | wordpress | 5.2 ≤ 𝑥 < 5.2.28 |
| wordpress | wordpress | 5.3 ≤ 𝑥 < 5.3.25 |
| wordpress | wordpress | 5.4 ≤ 𝑥 < 5.4.23 |
| wordpress | wordpress | 5.5 ≤ 𝑥 < 5.5.22 |
| wordpress | wordpress | 5.6 ≤ 𝑥 < 5.6.21 |
| wordpress | wordpress | 5.7 ≤ 𝑥 < 5.7.19 |
| wordpress | wordpress | 5.8 ≤ 𝑥 < 5.8.17 |
| wordpress | wordpress | 5.9 ≤ 𝑥 < 5.9.18 |
| wordpress | wordpress | 6.0 ≤ 𝑥 < 6.0.16 |
| wordpress | wordpress | 6.1 ≤ 𝑥 < 6.1.14 |
| wordpress | wordpress | 6.2 ≤ 𝑥 < 6.2.13 |
| wordpress | wordpress | 6.3 ≤ 𝑥 < 6.3.12 |
| wordpress | wordpress | 6.4 ≤ 𝑥 < 6.4.12 |
| wordpress | wordpress | 6.5 ≤ 𝑥 < 6.5.12 |
| wordpress | wordpress | 6.6 ≤ 𝑥 < 6.6.9 |
| wordpress | wordpress | 6.7 ≤ 𝑥 < 6.7.9 |
| wordpress | wordpress | 6.8 ≤ 𝑥 < 6.8.10 |
| wordpress | wordpress | 6.9 ≤ 𝑥 < 6.9.9 |
| wordpress | wordpress | 7.0 ≤ 𝑥 < 7.0.6 |
| wordpress | wordpress | 7.1 ≤ 𝑥 < 7.1.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases