WordPress get_page_template RCE actively exploited (CVE-2026-87902) [PoC]

Actively exploited in the wild - CVE-2026-87902 is a high-severity remote code execution vulnerability in WordPress that lets an unauthenticated attacker force get_page_template() page-template resolution to include a chosen readable local .php file outside the active theme directories. When the server and active theme pre-conditions are met, this leads to remote code execution.

Overview

WordPress resolves which template file renders a page through a function called get_page_template(). In CVE-2026-87902, an unauthenticated attacker can manipulate that resolution so the function includes a .php file of the attacker’s choosing from somewhere on the local filesystem, outside the active theme directories. Normally this resolution is constrained to theme folders; this bug breaks that constraint.

The severity is HIGH (CVSS 8.1). The vector is NETWORK, meaning an attacker reaches the target over the internet. No privileges and no user interaction are required - the attacker needs nothing but network access. The Attack Complexity is HIGH, which reflects the pre-conditions: the target server and the active theme must both satisfy specific requirements before the include turns into full code execution. When those conditions line up, the result is RCE. When they do not, the attacker may still be able to include and render a chosen local PHP file, which can leak file contents or trigger unintended behavior. CISA has added this CVE to its Known Exploited Vulnerabilities catalog.

Impact

For a site that meets the pre-conditions, an unauthenticated attacker can execute arbitrary PHP on the server. That means full compromise of the WordPress installation: reading or exfiltrating the database and configuration files, creating admin accounts, installing persistent backdoors, and pivoting to other services reachable from the host. Because no authentication is needed, mass exploitation is trivial once a working chain is public - and exploitation is already confirmed in the wild. Any site running an affected WordPress version and theme should treat itself as potentially compromised until proven otherwise.

Remediation and Mitigation

• Apply the vendor patch for CVE-2026-87902 as soon as it is available for your WordPress core version. Check the official WordPress security release notes for the fixed build.
• If you cannot patch immediately, restrict access to the site (IP allowlisting, maintenance mode with authentication) and deploy WAF rules that block crafted requests targeting template resolution.
• Audit for compromise: review recently modified files, unexpected administrator accounts, and unfamiliar scheduled tasks. Reset credentials and rotate salts and keys.
• Review themes and plugins - the active theme is part of the precondition, so keep all components updated and remove abandoned ones.
• Monitor logs for unusual include paths and repeated requests to index.php with manipulated query parameters.

Breach reports from past WordPress incidents are available at breach reports, and ongoing coverage is at security news.

Security Insight

This case shows how a single “resolution” helper in a CMS core can become an RCE primitive when paired with the right theme and server configuration - the kind of chained precondition that turns a hard-to-exploit bug into a mass-exploitation event once a working sequence surfaces. WordPress has historically been resilient against unauthenticated RCE, but its huge install base and the sheer variety of themes mean that conditional bugs like CVE-2026-87902 are functionally universal for some subset of sites. The fast move to the KEV catalog is the real signal: attackers found the preconditions at scale, and defenders should assume the same will happen to the next template-resolution quirk.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs