{"id":"CVE-2026-87902","aliases":["BIT-wordpress-2026-87902","BIT-wordpress-multisite-2026-87902","GHSA-7hp8-65ch-5whp"],"url":"https://o3.security/vulnerability/CVE-2026-87902","summary":null,"details":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","published":"2026-09-22T16:44:15.048Z","modified":"2026-11-08T02:47:43.902529266Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Bitnami","name":"wordpress","fixedVersion":"7.1.2"}],"fix":null,"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87902.json"},{"type":"ADVISORY","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87902"},{"type":"ADVISORY","url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-08T02:47:43.902529266Z"}}