Description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Published: 2026-09-22
Score: 8.1 High
EPSS: 40.0% Moderate
KEV: Yes
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

Unauthenticated attackers can exploit WordPress's get_page_template() function to include a user‑chosen readable .php file located outside the active theme directories. When the server and the theme meet the required pre‑conditions this inclusion can be leveraged to execute arbitrary code on the host, making this flaw a local file inclusion vulnerability (CWE‑98).

Affected Systems

All WordPress installations on branches back to 4.7 that have not applied the backported fix introduced in WordPress 7.1.2 are affected. Installations on older branches are also at risk if the fix has not been applied.

Risk and Exploitability

The vulnerability allows unauthenticated remote code execution and can be triggered through crafted requests to get_page_template(). It is scored 8.1 on the CVSS scale, indicating high severity. It is listed in the CISA KE catalog, and the EPSS score of 40% indicates a moderate probability of exploitation, though risk remains significant if the server and theme pre‑conditions are satisfied.

Generated by OpenCVE AI on October 8, 2026 at 19:09 UTC.

Remediation

Vendor Workaround

WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

OpenCVE Recommended Actions

  • Upgrade the WordPress installation to version 7.1.2 or any later release that includes the backported fix for get_page_template().
  • For installations on older branches that cannot be upgraded, apply the backported patch released in WordPress 7.1.2 to the relevant branch; this backported fix addresses the LFI issue.
  • Validate that the active theme resides in the correct directory and that no custom template files are located outside the theme folder; update or remove such files if necessary.
  • Implement input validation or a whitelist for template paths to prevent arbitrary local file inclusion, thereby protecting against future LFI exploits in WordPress.

Generated by OpenCVE AI on October 8, 2026 at 19:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6525-1 wordpress security update
History

Thu, 08 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Title WordPress LFI via get_page_template() Enables Remote Code Execution

Fri, 02 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Title WordPress LFI via get_page_template() Enables Remote Code Execution

Thu, 01 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated File Inclusion Enables Remote Code Execution in WordPress

Tue, 29 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated File Inclusion Enables Remote Code Execution in WordPress

Mon, 28 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Local File Inclusion Leading to Remote Code Execution via get_page_template() in WordPress

Mon, 28 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Sat, 26 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Title Local File Inclusion Leading to Remote Code Execution via get_page_template() in WordPress

Fri, 25 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
References

Fri, 25 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-09-25T00:00:00+00:00', 'dueDate': '2026-09-28T00:00:00+00:00'}

Fri, 25 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Title Local File Inclusion in WordPress get_page_template() Leading to Remote Code Execution

Tue, 22 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title Local File Inclusion in WordPress get_page_template() Leading to Remote Code Execution

Tue, 22 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 22 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Weaknesses CWE-98
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2026-09-26T03:55:51.560Z

Reserved: 2026-09-09T15:00:00.574Z

Link: CVE-2026-87902

cve-icon Vulnrichment

Updated: 2026-09-22T16:57:19.735Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T17:17:28.310

Modified: 2026-09-28T12:20:54.040

Link: CVE-2026-87902

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T19:15:20Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')