Ethical Hacking News
CVE-2026-87902 is a newly disclosed vulnerability in WordPress that can be exploited to achieve remote code execution. The vulnerability affects every version of WordPress back to 4.7.0 and can be triggered by a malicious page template path. Update to the latest version of WordPress to ensure your site is secure. Read more about this critical vulnerability and how to fix it in the full article.
CVE-2026-87902 is a critical vulnerability in WordPress, a content management system used by millions of websites worldwide. The vulnerability allows an attacker to achieve remote code execution due to an unauthenticated file inclusion bug. The vulnerability affects every version of WordPress back to 4.7.0, which is nearly a decade of releases. The vulnerability can be exploited by manipulating the page template path to include a malicious file. A patch has been released for this vulnerability, which is included in version 7.1.2 of WordPress. Updating WordPress to the latest version is the simplest and most effective way to fix this vulnerability.
CVE-2026-87902 is a newly disclosed vulnerability in WordPress, a content management system (CMS) used by millions of websites worldwide. The vulnerability, tracked as CVE-2026-87902, has a Critical Severity Score of 9.2, indicating a high level of risk. According to the cybersecurity firm PatchStack, the vulnerability is caused by an unauthenticated file inclusion bug in WordPress, which can be exploited to achieve remote code execution.
The vulnerability affects every version of WordPress back to 4.7.0, which is nearly a decade of releases. This means that millions of websites that use WordPress may be vulnerable to this attack. The vulnerability is triggered by the way WordPress resolves page templates, which can include a real path to remote code execution. The bug resides in the get_page_template() function, which uses the pagename value in the URL without proper validation.
The vulnerability can be exploited by an attacker who can manipulate the page template path to include a malicious file. Once the file is included, the PHP interpreter will execute the code in the file, potentially allowing the attacker to run arbitrary code on the server. The vulnerability is not limited to a single click, but rather requires a chain of events to occur.
The good news is that WordPress has already released a patch for this vulnerability, which is included in version 7.1.2. The patch addresses the reported bug and adds a new function, wp_is_template_path_allowed(), that every resolved template path now has to pass, regardless of which code path produced it. This suggests that the security team wanted to make sure there were no other ways to reach the same problem.
If you cannot patch right away, there are two quick checks you can perform to understand your exposure. First, check if your active theme contains a folder starting with "page-". Then, check whether PHP has register_argc_argv enabled. Neither of these checks is a fix, but they can help show whether your site could be affected.
Updating WordPress to the latest version is the simplest and most effective way to fix this vulnerability. The patch is included in version 7.1.2, and every supported branch back to 4.7.0 already has its own backported fix waiting. Pierluigi Paganini, the author of the article, concludes that "Treat it as critical unless you have checked your own stack and know otherwise."
In conclusion, CVE-2026-87902 is a critical vulnerability in WordPress that can be exploited to achieve remote code execution. The vulnerability affects every version of WordPress back to 4.7.0 and can be triggered by a malicious page template path. Fortunately, WordPress has released a patch for this vulnerability, and updating to the latest version is the simplest and most effective way to fix it.
Related Information:
https://www.ethicalhackingnews.com/articles/CVE-2026-87902-A-Remote-Code-Execution-Vulnerability-in-WordPress-ehn.shtml
https://securityaffairs.com/199564/hacking/cve-2026-87902-how-close-is-your-wordpress-to-remote-code-execution.html
Published: Wed Sep 23 03:44:38 2026 by llama3.2 3B Q4_K_M
