CVE-2026-87902: WordPress Core Remote File Inclusion Lets Attackers Achieve Remote Code Execution

Background

WordPress Core is the software foundation behind a substantial share of all websites on the internet, spanning everything from personal blogs to enterprise publishing platforms and e-commerce storefronts. A vulnerability in Core — as opposed to a third-party plugin or theme — has an unusually wide blast radius, because every installation running an affected version is potentially exposed regardless of which theme or plugins it uses.

CVE-2026-87902 affects WordPress Core’s page-template resolution logic: the mechanism Core uses to decide which PHP template file renders a given page. This logic normally restricts itself to template files inside the active theme (and its parent theme, for child themes). CVE-2026-87902 breaks that restriction, allowing a value supplied by an unauthenticated attacker to steer template resolution toward an arbitrary, attacker-chosen .php file elsewhere on the filesystem — as long as that file is readable by the web server process.

Technical Mechanism

The underlying weakness is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program — “PHP File Inclusion”).

It’s worth being precise about terminology here: the vendor’s vulnerability name describes this as a “remote file inclusion” issue, but the CISA KEV short description clarifies that the include target is a “chosen readable local .php file” rather than a file fetched over HTTP/FTP from a remote URL. Mechanically, this is closer to a path-traversal-driven local file inclusion (LFI): the attacker doesn’t upload or host the payload remotely, they redirect Core’s own include()/require() call toward a file that already exists somewhere readable on the server.

The attack flow works roughly as follows:

1. WordPress Core’s template loader builds a candidate file path based on input that is influenced by the request — for example, a page/post’s assigned template meta value, a query parameter, or a routing decision tied to the requested URL.
2. Because the logic that resolves this candidate path does not sufficiently constrain it to the active theme’s directory tree, an attacker can manipulate the input so the resolved path escapes the intended theme directory (via path traversal sequences, an absolute path, or an equivalent bypass) and instead points at any .php file the web server process has permission to read.
3. Core then executes a PHP include/require on that resolved path. Any PHP file reachable this way runs with the full privileges of the web server process — meaning if the attacker can get any readable PHP file onto the server first (via a media upload directory, a log file with a .php extension, a leftover file from a previous plugin, or a file planted through an unrelated vulnerability), this template-resolution flaw turns “readable” into “executable.”
4. The practical result is remote code execution: whatever PHP the included file contains runs in the context of the site, giving the attacker a foothold equivalent to a web shell.

Because the vulnerable code path is in WordPress Core itself, it affects the attack surface independent of which theme is active, which is what elevates this from a theme-specific bug to a Core-level, broadly exploitable issue.

Real-World Exploitation Evidence

CVE-2026-87902 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, added on September 25, 2026. Inclusion in KEV is itself the operative evidence of confirmed real-world exploitation — CISA only adds vulnerabilities to this catalog once active exploitation has been observed.

The KEV entry’s knownRansomwareCampaignUse field is recorded as “Unknown.” That means CISA has not confirmed this vulnerability has been used in ransomware campaigns at this time — it does not mean ransomware use is ruled out, only that it has not been publicly documented as of this writing.

No specific threat actor group, intrusion set, or named campaign has been publicly attributed to exploitation of CVE-2026-87902 in the data available for this article. If attribution details emerge, this article will be updated.

Impact Assessment

Given CWE-98’s mechanics and the CVSS 8.1 (high) rating, successful exploitation grants an attacker server-side code execution in the context of the web server process hosting WordPress — not merely information disclosure. That typically translates into:

• Confidentiality impact: Read access to wp-config.php and other configuration files, exposing database credentials, authentication secrets, and salts. From there, an attacker can pivot to the WordPress database directly.
• Integrity impact: Ability to modify site content, inject a persistent web shell, create rogue administrator accounts, or alter other files the web server can write to.
• Availability impact: Ability to deface, disable, or otherwise disrupt the site, and potentially use it as a staging point for further attacks (malware distribution, phishing pages, botnet participation).

Because WordPress commonly runs on shared hosting, a compromised instance can also pose risk to co-tenant sites on the same server if filesystem isolation between accounts is weak. For any organization using WordPress Core for customer-facing content, marketing, or e-commerce, this is a full-compromise-grade vulnerability, not a minor information leak.

Affected Versions

The KEV data provided for this article does not include an explicit vulnerable/fixed version matrix. The authoritative source is the vendor’s GitHub Security Advisory:

Organizations should treat any WordPress Core installation that has not applied the relevant security release as potentially vulnerable until confirmed otherwise against the GitHub advisory.

Remediation Steps

1. Update WordPress Core immediately to the version specified as fixed in GHSA-7hp8-65ch-5whp. Most managed WordPress hosts and sites with auto-updates enabled for minor/security releases will already have received this; self-hosted and manually managed installs should verify explicitly.

   # WP-CLI: check current core version and update
   wp core version
   wp core update
   wp core verify-checksums

2. Audit for pre-existing readable PHP files that should not be present — uploaded media directories, cache directories, or plugin leftovers that contain .php files outside expected locations. Remove anything unexpected.

3. Review file permissions so that the web server process has the minimum read access necessary; reducing what’s “readable” reduces what this flaw can be pivoted into executing.

4. Follow BOD 26-04 guidance on prioritizing security updates based on risk, and the associated Forensics Triage Requirements, for any internet-exposed WordPress deployment within scope of that directive.

5. If immediate patching isn’t possible, consider a web application firewall rule blocking anomalous template-related parameters containing path traversal sequences (../) or absolute paths as an interim compensating control — this is not a substitute for patching.

Detection Guidance

• Web server access logs: look for requests containing ../ sequences, absolute filesystem paths, or null-byte-style tricks in parameters associated with page/template selection.
• PHP error logs: failed or unusual include/require warnings referencing paths outside wp-content/themes/ can indicate exploitation attempts (successful or not).
• File integrity monitoring: alert on new or modified .php files appearing in uploads, cache, or other non-code directories.
• Outbound connections: a web shell dropped via this flaw often “calls home” or accepts further commands — monitor for anomalous outbound traffic from the web server process shortly after suspicious requests.

Exact detection signatures should ultimately come from your WAF/IDS vendor or the broader WordPress security community, as specific IOC data was not available at the time of writing.

Timeline

References

• GitHub Security Advisory GHSA-7hp8-65ch-5whp
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-87902