CVE-2026-87902: WordPress Template Resolution RCE Vulnerability

CVE-2026-87902 Overview

CVE-2026-87902 is a Local File Inclusion (LFI) vulnerability in WordPress affecting the get_page_template() page-template resolution logic. An unauthenticated attacker can coerce the resolver into including an arbitrary readable local .php file located outside the active theme directories. When specific server configurations and active theme conditions align, the flaw can escalate to Remote Code Execution (RCE). The issue is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Unauthenticated attackers can achieve remote code execution on affected WordPress installations when the preconditions in the server and active theme are met.

Affected Products

WordPress core (wordpress-develop repository, per the upstream advisory)
Sites using themes that expose the vulnerable get_page_template() resolution path
PHP-based WordPress deployments where readable .php files exist outside the theme directory

Discovery Timeline

2026-09-22 - CVE-2026-87902 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-87902

Vulnerability Analysis

The vulnerability resides in WordPress's page-template resolution routine, get_page_template(). An unauthenticated attacker influences the value used to build the include path so that resolution walks outside the active theme's directory. The resolver then includes an attacker-selected readable local .php file. Because PHP include and require execute the target file, any attacker-controlled or attacker-influenced .php on disk becomes executable in the WordPress process context.

Exploitation requires network access to the WordPress site and no authentication or user interaction. However, the attack complexity is high because the attacker must satisfy multiple preconditions: a readable local .php file must exist at a predictable path, and the active theme plus server configuration must allow the resolver to accept that path.

The advisory (GHSA-7hp8-65ch-5whp) provides the authoritative technical description.

Root Cause

The root cause is improper control of the filename passed to a PHP include construct within get_page_template(). The resolution logic accepts input that can traverse outside the intended theme directory, matching the pattern described by CWE-98. The resolver trusts the derived template path without validating that it stays within the theme's file system boundary.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request that reaches the page-template resolution code path. The request causes get_page_template() to construct a template path pointing at a readable local .php file outside the theme directory. WordPress then includes and executes the file. If the attacker can plant or influence the contents of a reachable .php file, for example through a prior benign upload, a log poisoning primitive, or a bundled plugin file with executable side effects, code execution follows.

No verified public proof-of-concept code is available. Refer to the WordPress security advisory for technical specifics.

Detection Methods for CVE-2026-87902

Indicators of Compromise

Unexpected HTTP requests targeting page-template resolution endpoints with unusual query parameters or path fragments
PHP process activity spawning shells, network connections, or file writes originating from the web server user
Web server access logs showing traversal-like sequences or references to .php files outside wp-content/themes/
New or modified .php files in writable directories such as wp-content/uploads/

Detection Strategies

Inspect PHP error and access logs for include/require operations that reference paths outside the active theme directory
Deploy a Web Application Firewall (WAF) rule that blocks requests attempting to influence template resolution with path-traversal patterns
Enable PHP open_basedir restrictions and alert on open_basedir violations in the PHP error log
Correlate anomalous outbound connections from the PHP-FPM or web server process against WordPress request telemetry

Monitoring Recommendations

Monitor file integrity for the WordPress core, theme, and plugin directories
Track process lineage from the web server to identify unexpected child processes such as sh, bash, python, or curl
Alert on writes of .php files into upload directories or any directory not part of the intentional deployment pipeline
Baseline normal template-resolution behavior and flag deviations in request rate or parameter shape

How to Mitigate CVE-2026-87902

Immediate Actions Required

Apply the WordPress security update referenced in GHSA-7hp8-65ch-5whp as soon as it is available for your release channel
Audit wp-content/uploads/ and other web-writable directories for unauthorized .php files and remove them
Restrict PHP execution in upload directories at the web server configuration layer
Review recent access logs for exploitation attempts against page-template resolution paths

Patch Information

Refer to the upstream advisory GitHub Security Advisory GHSA-7hp8-65ch-5whp for the fixed versions and commit references. Update WordPress core to the patched release and confirm the active theme is compatible with the fixed template resolution logic.

Workarounds

Configure PHP open_basedir to constrain include/require to the WordPress installation directory
Disable PHP execution in wp-content/uploads/ using web server directives such as Apache <FilesMatch> or Nginx location blocks
Deploy WAF signatures that reject requests attempting to manipulate page-template resolution
Temporarily switch to a theme not affected by the resolver preconditions if patching is delayed

bash

# Nginx: block PHP execution inside the uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# PHP-FPM: restrict include/require scope
# php.ini or pool config
open_basedir = "/var/www/wordpress/:/tmp/"