Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-87902: WordPress can load malicious PHP file from outside theme
CVE-2026-87902 · published 27 days ago · actively exploited
Summary
WordPress sites can be tricked into loading a PHP file that lives outside the theme folder, allowing an attacker to run their own code on the server. This can happen without the attacker needing a login. Update WordPress to the latest release and apply any security patches as soon as they are available.
What to do
- Update debian wordpress to version 6.8.10+dfsg1-0+deb13u1.
- Update wordpress to version 7.1.2.
- Update wordpress-multisite to version 7.1.2.
- Update debian wordpress to version 7.1.2+dfsg1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | wordpress | core | All versions |
| – | wordpress | wordpress |
< 7.1.2 >= 5.9, < 5.9.18 < 4.7.37 >= 4.8, < 4.8.32 >= 4.9, < 4.9.33 >= 5.0, < 5.0.29 >= 5.1, < 5.1.26 >= 5.2, < 5.2.28 >= 5.3, < 5.3.25 >= 5.4, < 5.4.23 >= 5.5, < 5.5.22 >= 5.6, < 5.6.21 14 more version ranges
|
| Debian:12 | debian | wordpress | All versions |
| Ubuntu:16.04:LTS | canonical | wordpress | All versions |
| Debian:13 | debian | wordpress |
< 6.8.10+dfsg1-0+deb13u1 Fix: upgrade to 6.8.10+dfsg1-0+deb13u1
|
| Bitnami | – | wordpress |
>= 7.1.0, < 7.1.2 < 7.1.2 Fix: upgrade to 7.1.2
|
| Bitnami | – | wordpress-multisite |
>= 7.1.0, < 7.1.2 < 7.1.2 Fix: upgrade to 7.1.2
|
| Debian:14 | debian | wordpress |
< 7.1.2+dfsg1-1 Fix: upgrade to 7.1.2+dfsg1-1
|
Original advisory text
WordPress Core Remote File Inclusion Vulnerability
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
References
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65c... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-87902 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-87902 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-87902 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-87902 URL
- https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpre... Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog Third Party Advisory
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
40%
chance of attack within 30 days
Type
CWE-98Improper Control of Filename for Include
Timeline
Published22 Sep 2026
Updated17 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-87902 · NVD
CVE-2026-87902 · MITRE
DEBIAN-CVE-2026-87902 · OSV
UBUNTU-CVE-2026-87902 · OSV
CVE-2026-87902 · CISA KEV
BIT-wordpress-2026-87902 · OSV
Track software like this
Free during beta