CVE-2026-87902

CRITICALPre-NVD 8.19.0▲
EchelonGraph scoreHIGH confidence

Score elevated to 9.0 because this CVE is listed on the CISA Known Exploited Vulnerabilities catalog (added 2026-09-25), indicating real-world exploitation has been confirmed by US federal agencies. CISA-ADP (Vulnrichment) CVSS v3.1 baseline 8.1 retained for reference (NVD's own analysis pending). Confidence: HIGH.

Triggered by: CISA KEV (actively exploited)
Sources: cisa-adp, cisa_kev, epss
Trending — KEV-added this weekExploited in the wild
9.0EG
EchelonGraph verdictPatch nowTreat as an emergency — this is being exploited.
  • 407 internet-facing services (distinct ip:port) on record running an affected version — derived from Shodan data (© Shodan); a patched service can stay counted while its port stays open
  • Actively exploited in the wild (CISA-KEV)
CISA-KEV: ExploitedEPSS PROB: 46%CVSS: 8.1Exploit: cisa kev · ssvc active · epss top5pct · public exploitExposed services: 407

A fix is available — apply it.

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Internet exposure · derived from Shodan data

407 internet-facing services (distinct ip:port) on record running a version that maps to CVE-2026-87902, in our KEV-Exposure radar’s Shodan-derived sample.

across 41 countries (United States, United Kingdom, Germany, India, France)top: wordpress
See the KEV-Exposure radar →Derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it. Aggregate, host-redacted.

How it counts: every 12 hours, when Shodan query credits allow, the radar runs one Shodan query per tracked product, reads up to 100 ip:port services per query, and keeps a service when its banner version matches a CISA-KEV or high-EPSS CVE; a service is dropped when neither a search nor a Shodan InternetDB port re-check has refreshed it for 21 days. A re-check that finds the port still listed by Shodan InternetDB refreshes the service without re-reading the banner, so a patched service can stay counted while its port stays open. A count is a banner-version inference over a sample, not an exploit test and not an internet-wide census, and the unit is a service, not a machine: a machine answering on two ports counts twice.

CVSS v3
8.1
EG Score
9.0CRITICALhigh confidence
EG Risk
81
EG Risk 81/100CISA SSVC

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity90% × 45%
Exploitation100% × 40%
Automatability0% × 15%
CISA SSVC: Track at low, Attend at medium and Act at high mission impact.
Action: A fix is available. Apply it within your standard update timelines at low, sooner than that at medium and as soon as possible at high mission impact.
EPSS PROB
46%
EPSS %ILE
98th
KEV
⚠ Exploited

CISA SSVCTrack at low, Attend at medium and Act at high mission impact.

A fix is available. Apply it within your standard update timelines at low, sooner than that at medium and as soon as possible at high mission impact.

Exploitation active (CISA Vulnrichment) · Automatable no (CISA Vulnrichment) · Technical impact total (CISA Vulnrichment). Mission impact is CISA's Mission & Well-being decision point, and only you can judge it: high means the affected system is essential to your organisation's mission, or its compromise could cause irreversible harm to people. CISA's decision table

Published

September 22, 2026

Last Modified

September 28, 2026

Advisory Details (1)

Auto-updated Sep 22, 2026
Patch available. Sources: github.
github Patch Available

Unauthenticated path traversal in page-template resolution leading to conditional RCE · Advisory · WordPress/wordpress-develop · GitHub

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 13× in last 7d / 29× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-10-03 14:33 UTCEG score recompute
  2. 2026-10-02 18:50 UTCEG score recompute
  3. 2026-10-01 23:12 UTCEG score recompute
  4. 2026-10-01 19:51 UTCEPSS rescore
  5. 2026-09-30 15:43 UTCEG score recompute
  6. 2026-09-30 15:04 UTCEPSS rescore
  7. 2026-09-29 16:03 UTCEG score recompute
  8. 2026-09-29 00:20 UTCEG score recompute
  9. 2026-09-28 16:27 UTCEG score recompute
  10. 2026-09-28 13:52 UTCEPSS rescore
  11. 2026-09-27 21:51 UTCCISA KEV update
  12. 2026-09-27 15:48 UTCEG score recompute
  13. 2026-09-27 13:48 UTCEPSS rescore
  14. 2026-09-26 20:10 UTCEG score recompute
  15. 2026-09-26 16:14 UTCEG score recompute
  16. 2026-09-26 15:59 UTCEPSS rescore
  17. 2026-09-26 00:32 UTCEG score recompute
  18. 2026-09-25 20:35 UTCEG score recompute
  19. 2026-09-25 19:36 UTCEG score recompute▲ 0.90
  20. 2026-09-25 19:35 UTCCISA KEV update
  21. 2026-09-24 16:21 UTCEG score recompute
  22. 2026-09-24 14:04 UTCEPSS rescore
  23. 2026-09-23 18:16 UTCEG score recompute
  24. 2026-09-23 17:54 UTCEPSS rescore
  25. 2026-09-23 07:14 UTCEG score recompute
Show 4 more
  1. 2026-09-22 17:10 UTCEG score recompute▲ 8.10
  2. 2026-09-22 17:08 UTCMITRE cvelistV5CVSS v3 → 8.1 · severity → HIGH
  3. 2026-09-22 16:51 UTCEG score recompute
  4. 2026-09-22 16:49 UTCMITRE cvelistV5first tracked

Publicly available exploits

(10 references)

Working exploit code is in the public domain (9 GitHub PoCs) (1 Exploit-DB entry). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.

  • Exploit-DBEDB-52690
    First seen Oct 1, 2026

    WordPress 7.0.2 - Path Travesal

    Open source ↗
  • GitHub PoCtonydelouvre/CVE-2026-87902
    First seen Sep 29, 2026

    XWP_RCE — CVE-2026-87902 Hacker Console

    Open source ↗
  • GitHub PoCHackfutSecRoot/CVE-2026-87902
    First seen Sep 28, 2026

    CVE-2026-87902 — WordPress Core LFI → RCE by Hackfut

    Open source ↗
  • GitHub PoCMaalfer/CVE-2026-87902-exploit
    First seen Sep 27, 2026

    Exploit para explotar la vulnerabilidad CVE-2026-87902 que se acontece en el core de WordPress

    Open source ↗
  • GitHub PoCcrowsec-edtech/CVE-2026-87902
    First seen Sep 25, 2026

    Proof of concept for vulnerability CVE-2026-87902 in Wordpress

    Open source ↗
  • GitHub PoCbhideki/CVE-2026-87902
    First seen Sep 23, 2026

    CVE-2026-87902: PoC for WordPress's critical path traversal

    Open source ↗
  • GitHub PoCdinosn/cve-2026-87902-wordpress-lfi-lab
    First seen Sep 23, 2026

    Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.

    Open source ↗
  • GitHub PoCHassham1/CVE-2026-87902
    First seen Sep 23, 2026

    WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)

    Open source ↗
  • GitHub PoCtc4dy/CVE-2026-87902-Toolkit
    First seen Sep 23, 2026

    CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. 🛠️ 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). 🔨 Use Ethically & Authorized Enviorement, Stay Legal <3

    Open source ↗
  • GitHub PoCynsmroztas/WPSniper
    First seen Sep 23, 2026

    CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.

    Open source ↗

Related CVEs(same CWE)

Frequently asked(6)

What is CVE-2026-87902?
CVE-2026-87902 is a critical vulnerability published on September 22, 2026. An unauthenticated attacker can make getpagetemplate() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
When was CVE-2026-87902 disclosed?
CVE-2026-87902 was first published on September 22, 2026, with the most recent update on September 28, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-87902 actively exploited?
Yes. CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities catalog on September 25, 2026, affecting WordPress Core. KEV listing indicates confirmed exploitation in the wild; this CVE warrants immediate attention. A fix is available. Apply it.
What is the CVSS score of CVE-2026-87902?
CVE-2026-87902 has a CVSS v3.1 base score of 8.1 (CISA-ADP / Vulnrichment enrichment; NVD's own analysis pending). EchelonGraph synthesises NVD + CISA KEV + FIRST EPSS + GHSA into a combined EG score of 9.0 (CRITICAL).
Which products are affected by CVE-2026-87902?
CVE-2026-87902 affects WordPress Core.
How do I remediate CVE-2026-87902?
A fix for CVE-2026-87902 is available: update to the fixed version the vendor names in its advisory.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-87902

Explore →

Is Your Infrastructure Affected by CVE-2026-87902?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs