CVE-2026-87902

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87902
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87902.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87902
Aliases
Downstream
DEBIAN (1)
MINI (2)
UBUNTU (1)
Published
2026-09-22T16:44:15Z
Modified
2026-11-08T02:47:43Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Database specific 
{
    "cna_assigner": "hackerone",
    "cwe_ids": [
        "CWE-98"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87902.json"
}
References

Affected packages

Git / github.com/wordpress/wordpress

Affected ranges

Type
GIT
Repo
https://github.com/wordpress/wordpress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b974c61ba56d7aab9e5aa928f921bb295d16965
Introduced
06fa4161aa74619239cf27017d124081c825684a
Fixed
d2107d8b699e5d3aec792cf4c50907d6288f4fc7
Introduced
29ffbff370968ae48a1b7a34e35c8b8e75cf0f91
Fixed
fe927b80c905197d02f55b0be4579864c89ebe17
Introduced
491c67be12ca8a9fe37ae38307ba7e298c976ec3
Fixed
bf829a2c84a789f026dcf2031d4d9563960fdb9a
Introduced
c33464a4554cff8a082bc353d9226d8104b80d2b
Fixed
bf8851400a9595ccb55e64dcc6be9cf37abe28e1
Introduced
6fe64752be3260f2a47f38e68c2cb77400e5a0c9
Fixed
4bc39aee09934e421bf2423eb23bff74a55b09a1
Introduced
50dc0ca5bb332c895f0f39fe4e6ee1e4a43e06dc
Fixed
c1b28183d0e6030d4759d68cb80432dcdf36809d
Introduced
9ff4499281663b0c772787fd4a60538288f842e9
Fixed
79580a19dc0de5b5be7ce659cd5a5703d2b3c881
Introduced
537fd931bc02e6e934a2d774422b897871aa87ad
Fixed
a0e82957c576e965f7af722d81ac26166e2df194
Introduced
965fcddcf68cf4fd122ae24b992e242dfea1d773
Fixed
032bc6e9accc94320f97902b44b5f17cc4c78d5d
Introduced
058f9903676a7efaee534a682df0a2a8b87574d8
Fixed
5aa4a8330fdc5961585b66bca4c2fa4975b086ad
Introduced
50caeb6e61ad0c49d2c7e1d6d5115047a011f590
Fixed
dc1be93bc16459a1a8fcfa1338b8291c7e3e1160
Introduced
73157386d069425c5e6ea7c4fc0122e8a9b58a7b
Fixed
96bc7ee1f43709f40711fc9395c0f3c2e511b19f
Introduced
cc101b64012b16d087780657a2b828ccd7794a63
Fixed
78612591f8c9dca7514fcaf0df48d54531c3ed7f
Introduced
6c5d5b5dcb9712bfc400b09cb6627e42898527af
Fixed
7dd9afe0a6769d0a5b1384cc3460fd4b7bdabffa
Introduced
17e2eff4aa3beb2802cbec12b6f08e2fbf69893d
Fixed
a3fdd1f57a6e0a9a760234efa386b2c4418a4007
Introduced
ac3899153a790a6f060dc816ff94812e0fd99875
Fixed
f96604eb17bb4aa7ab0680374df8efa6a2d3fe52
Introduced
e2d61d78ede843c2d05f44a4e15f30a57fb47d95
Fixed
cdc89a7cde831b0f1f1a6d86604eb509c1658152
Introduced
e75a577410e912e1408c49ace9103c3ee9997d76
Fixed
25815a9f89a15bc3c1e2c3930f16b8a33023de23
Introduced
b9bdf794320b132e6a4ce1538e988e6d31be33b0
Fixed
63f40acfe3ae391172c8ab6af1209f41a605bedb
Introduced
7766f0a793653329067bd50874872cc363af4461
Fixed
4e8671406b8dd91d1883e3d244cbf7cc11e41944
Introduced
6ba3d560fc2b033654f6dbfc6093fefb5c50f148
Fixed
6e6fa053d0c3e8b8ba34d2b51edde9da699b3d91
Introduced
ec24ee6087dad52052c7d8a11d50c24c9ba89a3b
Fixed
d393902c3f38df7bdec27236e5dcb049d0e321e0
Introduced
b16cd68ea199838d8f9daf0ff7e3f35042ba0ad0
Fixed
7fde92a30f5d457ff91a91351769319194466f1b
Introduced
b998fef9238af183f9523b3df71618e6e57498b6
Fixed
160387b7312c9407c7fe4b1d3dd2055206749a34
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.7.37"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.8"
                },
                {
                    "fixed": "4.8.32"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.9"
                },
                {
                    "fixed": "4.9.33"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.0.29"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.1"
                },
                {
                    "fixed": "5.1.26"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.2"
                },
                {
                    "fixed": "5.2.28"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.3"
                },
                {
                    "fixed": "5.3.25"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.4"
                },
                {
                    "fixed": "5.4.23"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.5"
                },
                {
                    "fixed": "5.5.22"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.6"
                },
                {
                    "fixed": "5.6.21"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.7"
                },
                {
                    "fixed": "5.7.19"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.8"
                },
                {
                    "fixed": "5.8.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.9"
                },
                {
                    "fixed": "5.9.18"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.0.16"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.1"
                },
                {
                    "fixed": "6.1.14"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.2"
                },
                {
                    "fixed": "6.2.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.3"
                },
                {
                    "fixed": "6.3.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.4"
                },
                {
                    "fixed": "6.4.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.5"
                },
                {
                    "fixed": "6.5.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.6"
                },
                {
                    "fixed": "6.6.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.7"
                },
                {
                    "fixed": "6.7.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.8"
                },
                {
                    "fixed": "6.8.10"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.9"
                },
                {
                    "fixed": "6.9.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.0.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.1"
                },
                {
                    "fixed": "7.1.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/wordpress/wordpress-develop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1f10f081fca544747aa0821291f0f5e83036cfb0
Introduced
2ac9b801ef5c18accf223b093529dacfcf809133
Fixed
160ccf9264c676f786454d704ce1864288ad70cc
Introduced
31f7ece8503f0dc6ef1df2473ae3f3d352973e12
Fixed
cbf4802135d0adddfa1dc3119d1dd510cb5531c8
Introduced
b3bf6266acd61682bc654845f621b4426645e324
Fixed
7e8f9088e01098cc7c4af090c1293f02127be685
Introduced
5aa596fee9bf6ea7f0ccc2ed51b16c0f2f04076b
Fixed
59f1e40c2998cf5bc5a69f5eb7fcc91d0bb804ac
Introduced
1cf3888655c0eb8b0b0539834ad67db5920190d7
Fixed
d02ba3eb14be2a292cf8a7cd3c744b9a103f4629
Introduced
d05f0a86b23e37b9d97acd9317ff3fd661d64dea
Fixed
4adf50f96257c3de7fd1461aacdd18d8bca85afb
Introduced
e0bedd676512ace4c5586337c072037298315f79
Fixed
8af9754d4ca343429f42a3333dd4ea73974bb2f8
Introduced
944a787b8071d3a27f4ac68980c21ed6137db91d
Fixed
92a8ddabe6221c8129a5e6aed3999bacb02993a1
Introduced
96a6969aab5f0b9362cbc984af230bdfc93022e8
Fixed
adc01e3a1f295623711c33baccb36cc9942dc97c
Introduced
895d6a691d7ccdfe80cdf999bc0c8a78d11ad55a
Fixed
c18b92b9203e158243e77d75e925e2a4f2792f0f
Introduced
4b54a6c2c9a3be775cc6dda66ed207998b068c8f
Fixed
8681f271b7780d8f90c04b8ab75a370389017db0
Introduced
b83a8be65054cd890e24c7c1416ebbb39aeb4c09
Fixed
b5fbaef7ac4d33fba475d2b76c2100386595364b
Introduced
1c0a2efa5eac05dfd3b7d2b9cfe68e02da55b966
Fixed
645b8112e05707a6f57b287fcb5c94128dc3af7b
Introduced
e33c9f3203961a823ec8410fc1481f6c87b4e3db
Fixed
b0554a93e60e7780ecc65ddf11493e531c26d7eb
Introduced
b829903bb0104bfeccc7623946a25cb7ccda1dea
Fixed
3e52d0f74320d236cdf0147ea85741f7ebb5e090
Introduced
4a6363076129378869f8742ef00a39a7421e6f29
Fixed
d532f18d63e4782cad3f72526999e431a689158f
Introduced
82dab16707a0a9af6a9707fed979a559aefdd511
Fixed
f57936455ed4e22e85bcf491250d26b5b7446522
Introduced
720804c22f867fe56332ab513428e945c24b889d
Fixed
af10567c99596a570a2d35e29c17280ad1e1fde9
Introduced
4115c99a784db8a787e2245300c83c9c8d336503
Fixed
f24c1235372807013c2ce032a3b536c072d7d41a
Introduced
262f4b6add2d1503bdd35611764ec58742b10fb9
Fixed
38fbfea21e62ed083d7d7a384c515fda220101cc
Introduced
a33a49e2e7f7e47656bc835996c692593edeba00
Fixed
a62d18131a90b23ec55a21e24702abc5a24eee29
Introduced
3a87241015aff96c7a38c1304949908b9588b218
Fixed
8491a9be893ce6e451afcda71bc9c76ae0f85a60
Introduced
26b68024931348d267b70e2a29910e1320d0094f
Fixed
ec455a506d511d8d233ae4ba158f1163c13dd888
Introduced
daaca56d3d6a9a42a0c87f6eda766c33a77c1d05
Fixed
0a106cde38df869e196a83eb4975ba38a4e5837b
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.7.37"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.8"
                },
                {
                    "fixed": "4.8.32"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.9"
                },
                {
                    "fixed": "4.9.33"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.0.29"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.1"
                },
                {
                    "fixed": "5.1.26"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.2"
                },
                {
                    "fixed": "5.2.28"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.3"
                },
                {
                    "fixed": "5.3.25"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.4"
                },
                {
                    "fixed": "5.4.23"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.5"
                },
                {
                    "fixed": "5.5.22"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.6"
                },
                {
                    "fixed": "5.6.21"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.7"
                },
                {
                    "fixed": "5.7.19"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.8"
                },
                {
                    "fixed": "5.8.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.9"
                },
                {
                    "fixed": "5.9.18"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.0.16"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.1"
                },
                {
                    "fixed": "6.1.14"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.2"
                },
                {
                    "fixed": "6.2.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.3"
                },
                {
                    "fixed": "6.3.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.4"
                },
                {
                    "fixed": "6.4.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.5"
                },
                {
                    "fixed": "6.5.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.6"
                },
                {
                    "fixed": "6.6.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.7"
                },
                {
                    "fixed": "6.7.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.8"
                },
                {
                    "fixed": "6.8.10"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.9"
                },
                {
                    "fixed": "6.9.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.0.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.1"
                },
                {
                    "fixed": "7.1.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

4.*
4.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87902.json"