{"id":"CVE-2026-87902","kind":"vulnerability","aliases":["CVE-2026-87902"],"related":[],"title":"wordpress: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local…","description":"WAF Release - 2026-09-25 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 25, 2026\n\n## WAF Release - 2026-09-25 - Emergency\n\nThis update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.\n\nKey Findings\n\n- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.\n- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.\n\nImpact\n\nWe strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.\n\nDetailed Rule Changes\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |","summary":"Unauthenticated file inclusion in get_page_template(): the pagename-derived candidate skipped validate_file(), so an attacker can include a readable local .php file outside the theme. Always a file-inclusion; RCE needs a theme with a top-level page-* directory (Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney) plus a usable PHP file such as PEAR pearcmd.php with register_argc_argv=On (official php Docker image; cPanel with PHP before 8.5). Exploited in the wild since 2026-09-22.","severity":"critical","cvss":8.1,"epss":null,"exploited":true,"exploited_at":"2026-09-25T00:00:00+00:00","products":[{"name":"WordPress Core","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"WordPress Core","fixed":["7.1.2","7.0.6","6.9.9","6.8.10","6.7.9","6.6.9","6.5.12","6.4.12","6.3.12","6.2.13","6.1.14","6.0.16","5.9.18","5.8.17","5.7.19","5.6.21","5.5.22","5.4.23","5.3.25","5.2.28","5.1.26","5.0.29","4.9.33","4.8.32","4.7.37"],"affected":">= 4.7.0, <= 7.1.1 (every branch below its patched release)","ecosystem":"vendor"},{"name":"wordpress","fixed":["4.7.37"],"affected":"< 4.7.37","ecosystem":"vendor"},{"name":"wordpress","fixed":["4.8.32"],"affected":">= 4.8, < 4.8.32","ecosystem":"vendor"},{"name":"wordpress","fixed":["4.9.33"],"affected":">= 4.9, < 4.9.33","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.0.29"],"affected":">= 5.0, < 5.0.29","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.1.26"],"affected":">= 5.1, < 5.1.26","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.2.28"],"affected":">= 5.2, < 5.2.28","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.3.25"],"affected":">= 5.3, < 5.3.25","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.4.23"],"affected":">= 5.4, < 5.4.23","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.5.22"],"affected":">= 5.5, < 5.5.22","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.6.21"],"affected":">= 5.6, < 5.6.21","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.7.19"],"affected":">= 5.7, < 5.7.19","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.8.17"],"affected":">= 5.8, < 5.8.17","ecosystem":"vendor"},{"name":"wordpress","fixed":["5.9.18"],"affected":">= 5.9, < 5.9.18","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.0.16"],"affected":">= 6.0, < 6.0.16","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.1.14"],"affected":">= 6.1, < 6.1.14","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.2.13"],"affected":">= 6.2, < 6.2.13","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.3.12"],"affected":">= 6.3, < 6.3.12","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.4.12"],"affected":">= 6.4, < 6.4.12","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.5.12"],"affected":">= 6.5, < 6.5.12","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.6.9"],"affected":">= 6.6, < 6.6.9","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.7.9"],"affected":">= 6.7, < 6.7.9","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.8.10"],"affected":">= 6.8, < 6.8.10","ecosystem":"vendor"},{"name":"wordpress","fixed":["6.9.9"],"affected":">= 6.9, < 6.9.9","ecosystem":"vendor"},{"name":"wordpress","fixed":["7.0.6"],"affected":">= 7.0, < 7.0.6","ecosystem":"vendor"},{"name":"wordpress","fixed":["7.1.2"],"affected":">= 7.1, < 7.1.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","lab-disclosure","php","runtime","self-hosted","wordpress"],"not_affected_if":["managed-hosting","wordpress-com"],"how_to_check":"Run 'wp core version' or check wp-includes/version.php: any version below your branch's fixed release is vulnerable. Then see if the active theme (and parent) has a top-level directory starting with 'page-' (ls wp-content/themes/<theme>/), and whether PHP has register_argc_argv on (php -i | grep register_argc_argv). Both conditions met means RCE is reachable. Since exploitation began 2026-09-22, look for web shells or new .php files in uploads/themes and for requests with encoded ../ or pearcmd in pagename; CISA flags forensic triage.","fix":"Update to 7.1.2 (or backport for your branch: 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37). Auto-updates may have applied it already. If you cannot update: no vendor workaround; a WAF rule (Patchstack RapidMitigate) helps. Remove or rename a page-* theme directory and disable register_argc_argv to lower exposure. Assume compromise if unpatched since 2026-09-22 and investigate.","status":"resolved","published_at":"2026-09-22T17:17:28+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:10+00:00","updated_at":"2026-10-24T17:31:12+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T19:50:10Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's WordPress Core update or mitigation; the fixed version is unknown from the sources. Follow CISA BOD 26-04 guidance for the affected assets.","summary":"WordPress Core has a remote file inclusion flaw in page-template resolution that lets an unauthenticated attacker make WordPress include a chosen readable local .php file from outside the active theme directories. The result is remote code execution on the WordPress server, and CISA lists it as actively exploited.","category":"runtime","who_cares":["wordpress","self-hosted","php"],"confidence":0.6,"analyst_note":"Find the fixed WordPress core version and vendor mitigation from wordpress.org security release notes and the CISA KEV entry for CVE-2026-87902, since the sources list affected and fixed versions as unknown.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","wordpress-com"],"severity_if_unknown":"critical"},"cost_usd":0.000391,"input_tokens":2208,"output_tokens":340,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed WordPress core version and vendor mitigation from wordpress.org security release notes and the CISA KEV entry for CVE-2026-87902, since the sources list affected and fixed versions as unknown.","search":"'-09':145B,150C,167C '-2026':20A,23A,202C,241C,244C,319C,354C,374C '-22':146B '-25':151C,168C '-42018':242C,355C '-82329':245C,375C '-87902':21A,24A,203C,320C '2026':144B,149C,163C,166C '25':162C '70a43f96':309C '8.5':138B '909a4db4':331C 'a813ac74':366C 'access':265C 'achiev':263C 'action':302C,304C 'administr':275C 'affect':178C,216C,250C 'allow':255C 'alway':93B 'appli':276C 'arbitrari':226C 'argc':127B 'argv':128B 'artifactori':182C,252C,268C,285C,349C,369C 'attack':4A,82B,219C,257C 'authent':196C,247C,350C,370C 'block':322C,337C,357C,377C 'bypass':197C,248C,259C,351C,371C 'c797ef03':346C 'candid':76B 'chang':293C 'changelog':153C,154C 'chosen':16A 'cloudflar':54B,160C,306C,328C,343C,363C 'comment':305C,335C 'configur':235C 'control':261C 'core':26A,28A 'cpanel':134B 'critic':176C,246C 'cross':191C 'cross-sit':190C 'cve':19A,22A,201C,240C,243C,317C,318C,352C,353C,372C,373C 'data':236C 'defens':174C 'deriv':75B 'descript':300C 'detail':291C 'detect':327C,342C,362C,382C 'directori':108B 'disclosur':58B 'docker':132B 'emerg':152C,169C 'exploit':55B,139B,198C,221C,254C 'expos':233C 'file':66B,79B,89B,96B,120B,187C,212C,227C,239C,315C 'file-inclus':95B 'find':200C 'flaw':223C 'fourteen':112B 'fulli':287C 'get':7A,69B 'hestia':114B 'high':206C 'high-sever':205C 'host':63B,230C 'id':296C,299C 'imag':133B 'immedi':173C 'impact':270C 'improv':158C 'includ':14A,84B,183C 'inclus':67B,97B,188C,213C,316C 'instanc':269C 'jfrog':181C,251C,284C,348C,368C 'key':199C 'lab':57B 'lab-disclosur':56B 'latest':278C 'legaci':297C 'level':106B 'lfi':189C,214C 'local':18A,87B,186C,211C,314C 'make':6A 'manag':307C,329C,344C,364C 'n/a':310C,321C,332C,336C,347C,356C,367C,376C 'need':99B 'neve':113B 'new':155C,303C,326C,341C,361C,381C 'offici':130B 'origin':289C 'outsid':90B 'page':8A,11A,70B,107B 'page-templ':10A 'pagenam':74B 'pagename-deriv':73B 'patch':280C 'path':184C,208C,312C 'pear':123B 'pearcmd.php':124B 'php':59B,88B,119B,131B,136B 'plus':116B 'potenti':232C 'previous':301C 'provid':172C 'rce':98B 'read':225C 'readabl':17A,86B 'recommend':273C 'regist':126B 'releas':148C,165C 'resolut':13A 'rule':292C,295C,298C 'ruleset':294C,308C,330C,345C,365C 'runtim':60B 'script':193C 'secur':260C,288C 'self':62B 'self-host':61B 'sensit':234C 'septemb':161C 'server':231C,290C 'sever':207C 'sinc':143B 'site':192C 'skip':77B 'strong':272C 'success':253C 'sydney':115B 'system':238C 'templat':9A,12A,71B 'theme':92B,101B 'top':105B 'top-level':104B 'travers':185C,209C,313C 'twelv':110B 'twenti':109B,111B 'unauthent':3A,65B,218C,256C 'unauthor':264C 'updat':156C,171C 'usabl':118B 'valid':78B 'vendor':279C 'vulner':177C,215C,249C 'waf':147C,164C 'wild':142B 'wordpress':1A,25A,27A,29A,30A,31A,32A,33A,34A,35A,36A,37A,38A,39A,40A,41A,42A,43A,44A,45A,46A,47A,48A,49A,50A,51A,52A,53A,64B,179C,217C,282C,311C,333C 'xss':194C,334C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":"2026-09-25","covers":"HTTP requests proxied through Cloudflare matching the WordPress path traversal and LFI rule (Cloudflare Managed Ruleset rule ...70a43f96)","limits":"Traffic not proxied through Cloudflare; origin servers reachable directly; non-HTTP paths","source":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:12Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog","customer_action":"Apply the latest WordPress vendor patch to fully secure origin servers, as Cloudflare recommends"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T17:17:28+00:00","kev":{"dateAdded":"2026-09-25","dueDate":"2026-09-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-87902","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","severity":null,"published_at":"2026-09-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87902:2","url":null,"severity":null,"published_at":"2026-10-23T20:08:26+00:00","modified_at":"2026-10-23T20:08:26+00:00","first_seen_at":"2026-10-23T20:08:26+00:00","fetched_at":"2026-10-23T20:08:26+00:00","note":"Primary GHSA-7hp8-65ch-5whp and wordpress.org 7.1.2 release: affected 4.7.0-7.1.1, fixed 7.1.2 plus backports to every branch; CISA KEV 2026-09-25, exploitation seen within hours (BleepingComputer/Patchstack). No public PoC link found; Patchstack withheld request."},{"source":"nvd","external_id":"CVE-2026-87902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902","severity":null,"published_at":"2026-09-22T17:17:28+00:00","modified_at":"2026-09-28T12:20:54+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/#CVE-2026-87902","url":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","severity":null,"published_at":"2026-09-25T17:18:07+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog"}],"documents":[{"id":3,"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","title":"GHSA-7hp8-65ch-5whp: WordPress page-template resolution conditional RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":4,"url":"https://wordpress.org/news/2026/09/wordpress-7-1-2-release/","title":"WordPress 7.1.2 Release","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":5,"url":"https://patchstack.com/articles/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce/","title":"Patchstack: WordPress 7.1.2 Unauthenticated LFI to RCE","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":6,"url":"https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/","title":"BleepingComputer: Hackers start exploiting critical WordPress flaw","kind":"post","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":2845,"url":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-09-25 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 25, 2026\n\n## WAF Release - 2026-09-25 - Emergency\n\nThis update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.\n\nKey Findings\n\n- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.\n- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.\n\nImpact\n\nWe strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.\n\nDetailed Rule Changes\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |","published_at":"2026-09-25T17:18:07+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}