important · WordPress
A public WordPress request can turn template traversal into PHP execution, but only on a narrow configuration.
Affects
WordPress Core, the PHP content-management system used by self-hosted websites.
A double-encoded pagename survives early sanitization, is decoded during template resolution and escapes the theme root through an unchecked local PHP include.
Detail and 4 sources
The reproduction required a published page, a qualifying top-level page-* theme directory and a usable local PHP path; the demonstration used PEAR's pearcmd.php to write and include controlled PHP.
WordPress has fixed the affected branches, and public proof-of-concept code exists.
Sources
ResearchCVE-2026-87902: Critical WordPress file inclusion and conditional RCE — Robert ResslResearchWordPress 7.1.2 Release – WordPress NewsCode / PoCGitHub - ressl/cve-2026-87902-poc: PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab · GitHubSecondaryWordPress core unauthenticated path traversal with conditional RCE (CVE-2026-87902)