cyfenced.com →

[ CVE-2026-87902 · Published 22 Sep 2026 ]

Local file inclusion in WordPress core can lead to code execution

Exploited · CISA KEV CVSS 8.1 EPSS 40%3 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-25
  • EPSS: 40% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and it needs no credentials, although specific server and theme conditions must be met.

Red alert if
You run WordPress older than 7.1.2 with automatic updates switched off.
Can wait if
Your sites have already updated to 7.1.2, or you do not use WordPress.
What it is
WordPress page-template resolution can be made to include a chosen local .php file outside the active theme directories, without logging in. If certain conditions in the server and active theme are met, this leads to remote code execution. WordPress before 7.1.2 is affected.
Impact
An attacker without an account could run code on the web server, but only on sites whose server and theme meet specific conditions. A compromised WordPress site can be defaced, used to spread malware to visitors or used to steal customer data and admin credentials.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends crafted requests to the public WordPress site.
  2. T1059 Command and Scripting InterpreterAn included PHP file runs code as the web server user.
  3. T1505.003 Server Software Component: Web ShellA web shell or malicious plugin keeps access.
  4. T1491 DefacementThe site's content is changed or used to serve malicious code.

What to do

  1. Check that every WordPress site runs 7.1.2 or later; automatic background updates usually install this, but confirm it in the dashboard.
  2. Update the active theme and plugins as well.
  3. Look for unknown PHP files, new administrator accounts and plugins you did not install.
  4. If you find signs of compromise, restore from a clean backup and change all admin and database passwords.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CISA: WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 28 Sep 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References