CVE-2026-87902 in wordpress
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Affected software: wordpress
Scores
- CVSS: 8.1 (high)
- EPSS: 95.77% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-09-25
- Published: 2026-09-22
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update WordPress core to the patched maintenance release (CVE-2026-87902)
Patch or upgrade. Update WordPress core to the security release for your branch, which stops get_page_template() from including PHP files outside the theme through the pagename parameter. The flaw is exploited in the wild.
Applies to: WordPress core branches listed as affected in advisory GHSA-7hp8-65ch-5whp, before the patched maintenance release.
- List every WordPress site and note the version under Dashboard, Updates or with 'wp core version'.
- Update core to the newest maintenance release of your branch: Dashboard, Updates, Update now, or 'wp core update' followed by 'wp core update-db'.
- Make sure automatic background updates for minor (security) releases stay on (WP_AUTO_UPDATE_CORE set to 'minor' or true).
- If you cannot update at once, block requests whose pagename parameter contains '..' or encoded dots (%2e, %252e) in the WAF or reverse proxy.
- Check the access log for such requests and look for unknown PHP files and admin users on sites that were exposed.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.