---
id: "CVE-2026-87902"
kind: "vulnerability"
aliases: ["CVE-2026-87902"]
title: "wordpress: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local\u2026"
severity: "critical"
cvss: 8.1
epss: null
exploited: true
status: "resolved"
category: "runtime"
products: [{"name": "WordPress Core", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "WordPress Core", "fixed": ["7.1.2", "7.0.6", "6.9.9", "6.8.10", "6.7.9", "6.6.9", "6.5.12", "6.4.12", "6.3.12", "6.2.13", "6.1.14", "6.0.16", "5.9.18", "5.8.17", "5.7.19", "5.6.21", "5.5.22", "5.4.23", "5.3.25", "5.2.28", "5.1.26", "5.0.29", "4.9.33", "4.8.32", "4.7.37"], "affected": ">= 4.7.0, <= 7.1.1 (every branch below its patched release)", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["4.7.37"], "affected": "< 4.7.37", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["4.8.32"], "affected": ">= 4.8, < 4.8.32", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["4.9.33"], "affected": ">= 4.9, < 4.9.33", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.0.29"], "affected": ">= 5.0, < 5.0.29", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.1.26"], "affected": ">= 5.1, < 5.1.26", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.2.28"], "affected": ">= 5.2, < 5.2.28", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.3.25"], "affected": ">= 5.3, < 5.3.25", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.4.23"], "affected": ">= 5.4, < 5.4.23", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.5.22"], "affected": ">= 5.5, < 5.5.22", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.6.21"], "affected": ">= 5.6, < 5.6.21", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.7.19"], "affected": ">= 5.7, < 5.7.19", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.8.17"], "affected": ">= 5.8, < 5.8.17", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["5.9.18"], "affected": ">= 5.9, < 5.9.18", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.0.16"], "affected": ">= 6.0, < 6.0.16", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.1.14"], "affected": ">= 6.1, < 6.1.14", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.2.13"], "affected": ">= 6.2, < 6.2.13", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.3.12"], "affected": ">= 6.3, < 6.3.12", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.4.12"], "affected": ">= 6.4, < 6.4.12", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.5.12"], "affected": ">= 6.5, < 6.5.12", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.6.9"], "affected": ">= 6.6, < 6.6.9", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.7.9"], "affected": ">= 6.7, < 6.7.9", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.8.10"], "affected": ">= 6.8, < 6.8.10", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["6.9.9"], "affected": ">= 6.9, < 6.9.9", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["7.0.6"], "affected": ">= 7.0, < 7.0.6", "ecosystem": "vendor"}, {"name": "wordpress", "fixed": ["7.1.2"], "affected": ">= 7.1, < 7.1.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloudflare", "exploited", "lab-disclosure", "php", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["managed-hosting", "wordpress-com"]
published_at: "2026-09-22T17:17:28+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-24T17:31:12+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:08:26+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87902", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/", "first_seen_at": "2026-10-24T17:18:15+00:00"}]
---

# wordpress: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local…

Unauthenticated file inclusion in get_page_template(): the pagename-derived candidate skipped validate_file(), so an attacker can include a readable local .php file outside the theme. Always a file-inclusion; RCE needs a theme with a top-level page-* directory (Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney) plus a usable PHP file such as PEAR pearcmd.php with register_argc_argv=On (official php Docker image; cPanel with PHP before 8.5). Exploited in the wild since 2026-09-22.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WordPress Core affected ? fixed ?
- vendor:WordPress Core affected >= 4.7.0, <= 7.1.1 (every branch below its patched release) fixed 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37
- vendor:wordpress affected < 4.7.37 fixed 4.7.37
- vendor:wordpress affected >= 4.8, < 4.8.32 fixed 4.8.32
- vendor:wordpress affected >= 4.9, < 4.9.33 fixed 4.9.33
- vendor:wordpress affected >= 5.0, < 5.0.29 fixed 5.0.29
- vendor:wordpress affected >= 5.1, < 5.1.26 fixed 5.1.26
- vendor:wordpress affected >= 5.2, < 5.2.28 fixed 5.2.28
- vendor:wordpress affected >= 5.3, < 5.3.25 fixed 5.3.25
- vendor:wordpress affected >= 5.4, < 5.4.23 fixed 5.4.23
- vendor:wordpress affected >= 5.5, < 5.5.22 fixed 5.5.22
- vendor:wordpress affected >= 5.6, < 5.6.21 fixed 5.6.21
- vendor:wordpress affected >= 5.7, < 5.7.19 fixed 5.7.19
- vendor:wordpress affected >= 5.8, < 5.8.17 fixed 5.8.17
- vendor:wordpress affected >= 5.9, < 5.9.18 fixed 5.9.18
- vendor:wordpress affected >= 6.0, < 6.0.16 fixed 6.0.16
- vendor:wordpress affected >= 6.1, < 6.1.14 fixed 6.1.14
- vendor:wordpress affected >= 6.2, < 6.2.13 fixed 6.2.13
- vendor:wordpress affected >= 6.3, < 6.3.12 fixed 6.3.12
- vendor:wordpress affected >= 6.4, < 6.4.12 fixed 6.4.12
- vendor:wordpress affected >= 6.5, < 6.5.12 fixed 6.5.12
- vendor:wordpress affected >= 6.6, < 6.6.9 fixed 6.6.9
- vendor:wordpress affected >= 6.7, < 6.7.9 fixed 6.7.9
- vendor:wordpress affected >= 6.8, < 6.8.10 fixed 6.8.10
- vendor:wordpress affected >= 6.9, < 6.9.9 fixed 6.9.9
- vendor:wordpress affected >= 7.0, < 7.0.6 fixed 7.0.6
- vendor:wordpress affected >= 7.1, < 7.1.2 fixed 7.1.2

## How to check

Run 'wp core version' or check wp-includes/version.php: any version below your branch's fixed release is vulnerable. Then see if the active theme (and parent) has a top-level directory starting with 'page-' (ls wp-content/themes/<theme>/), and whether PHP has register_argc_argv on (php -i | grep register_argc_argv). Both conditions met means RCE is reachable. Since exploitation began 2026-09-22, look for web shells or new .php files in uploads/themes and for requests with encoded ../ or pearcmd in pagename; CISA flags forensic triage.

## Fix

Update to 7.1.2 (or backport for your branch: 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37). Auto-updates may have applied it already. If you cannot update: no vendor workaround; a WAF rule (Patchstack RapidMitigate) helps. Remove or rename a page-* theme directory and disable register_argc_argv to lower exposure. Assume compromise if unpatched since 2026-09-22 and investigate.

## Mitigated for you by

- Cloudflare (waf-rule, since 2026-09-25): covers HTTP requests proxied through Cloudflare matching the WordPress path traversal and LFI rule (Cloudflare Managed Ruleset rule ...70a43f96) Limits: Traffic not proxied through Cloudflare; origin servers reachable directly; non-HTTP paths Still: Apply the latest WordPress vendor patch to fully secure origin servers, as Cloudflare recommends https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902
- 2026-10-23T20:08:26+00:00 analyst — Primary GHSA-7hp8-65ch-5whp and wordpress.org 7.1.2 release: affected 4.7.0-7.1.1, fixed 7.1.2 plus backports to every branch; CISA KEV 2026-09-25, exploitation seen within hours (BleepingComputer/Patchstack). No public PoC link found; Patchstack withheld request.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87902
- 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ — Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog

## Documents

- [advisory] GHSA-7hp8-65ch-5whp: WordPress page-template resolution conditional RCE https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- [advisory] Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/
- [describes] Patchstack: WordPress 7.1.2 Unauthenticated LFI to RCE https://patchstack.com/articles/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce/
- [discussion] BleepingComputer: Hackers start exploiting critical WordPress flaw https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/
- [fix] WordPress 7.1.2 Release https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

## From the sources

WAF Release - 2026-09-25 - Emergency · Changelog

# Changelog

New updates and improvements at Cloudflare.

September 25, 2026

## WAF Release - 2026-09-25 - Emergency

This update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.

Key Findings

- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.
- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.

Impact

We strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.

Detailed Rule Changes

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_