Skip to content

CVE-2026-87902

Named by 4 kept items in this workspace.

Search every workspace for CVE-2026-87902. It matches the name as written, so it can find other things that share it.

The items that name it 4

  • Check Point Research — 28th September Threat Intelligence Report
    article2026-09-28

    WordPress vulnerability (versions before 7.1.2) allowing unauthenticated attackers to include local PHP files outside active theme directories; attackers exploiting it to write malicious PHP files and execute commands under specific server and theme configurations. Fixed by WordPress.

  • WordPress 7.1.2 Release (CVE-2026-87902 path-traversal RCE fix)
    advisory2026-09-22

    Unauthenticated attacker can make page template resolution include a chosen readable local PHP file outside the active theme directories; under certain server and theme preconditions can lead to remote code execution (RCE)

  • Attackers Exploit WordPress CVE-2026-87902 Within Hours of Patch
    advisory

    Unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories, potentially leading to RCE if preconditions are met

  • Known Exploited Vulnerabilities Catalog | CISA
    otherIt is written here as CVE-2026-87902 (WordPress Core remote file inclusion; CWE-98; added 2026-09-25, due 2026-09-28).

    WordPress Core remote file inclusion; CWE-98; added 2026-09-25, due 2026-09-28

All cves in this workspace.