What Happened (Plain English)
High-risk WordPress WordPress weakness requires patching (CVE-2026-87902) affects WordPress WordPress. FIRST EPSS telemetry places exploitation probability at 95.77%. With a CVSS score of 7.8 (HIGH), security teams should verify affected deployments and prioritize remediation according to exposure.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. Unpatched internet-facing or user-accessible instances risk unauthorized execution, data exposure, or service disruption.
Affected Software & Weakness
Vendor: WordPress · Product: WordPress · Versions: WordPress 0 · CWE: CWE-98
The Fix
Verify your installed WordPress version against WordPress's official security bulletin for CVE-2026-87902, apply the patched build in a staging ring first when possible, and confirm rollout across all production nodes.
Temporary Workarounds
If patching WordPress WordPress cannot happen today, place management ports behind VPN or zero-trust access, restrict untrusted network ingress, and enforce multi-factor authentication on administrative sessions.
Detection & Log Checks
Inspect WordPress application logs, perimeter firewall denies/allows, and EDR process trees for unusual child processes or outbound connections correlated with CVE-2026-87902 (CWE-98).
Frequently Asked Questions
Is CVE-2026-87902 actively exploited?
No KEV listing yet, but EPSS exploitation probability is 95.77%.
What is the fix for CVE-2026-87902?
Upgrade WordPress to >= 7.1.2 (CVE-2026-87902 vendor patch).
Which WordPress products are affected?
WordPress WordPress (WordPress 0).
How urgent is patching CVE-2026-87902?
Priority queue: THIS-WEEK (CVSS 7.8, EPSS 95.77%).
Official References
Last verified: 2026-11-13 · Defensive checklist only.