CVE-2026-87902
KEV High · CVSS 8.1- CVSS
- 8.1
- nvd
- EPSS
- 22.5%
- 98th pct
- KEV
- Listed
- 2026-09-25
- Class
- other
- CWE-98
Description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
References
Status: profiled · ingested 2026-09-28T18:00:02.000Z