WordPress page template include hits CISA KEV

Originally published at HOL

CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities catalog today (2026-09-25). WordPress Core has an unauthenticated path traversal in page-template resolution: an attacker can make get_page_template() include a chosen readable local .php file outside the active theme directories. When the theme and PHP environment preconditions line up, that local file inclusion becomes remote code execution. GHSA-7hp8-65ch-5whp rates it critical (CVSS 4.0 9.2). Federal KEV due date is 2026-09-28. Forensic triage is Yes under BOD 26-04. Known ransomware campaign use is Unknown.

WordPress shipped the fix in 7.1.2 on 2026-09-22 and backported it through every supported branch back to 4.7. Patchstack reports probing hours after the patch, then active attempts that include pearcmd.php and write PHP to disk. This page is the operator write-up from the GHSA, the WordPress 7.1.2 release, CISA KEV, and Patchstack. The HOL Guard evidence pack for CVE-2026-87902 is the linked source record.

What breaks

Unauthenticated requests can abuse page-template resolution so WordPress includes a local .php the attacker picks, as long as that file is readable by the web server. The GHSA names two preconditions that turn LFI into conditional RCE:

Theme layout: the active child or parent theme has a top-level directory whose name starts with page- (for example page-templates). That hits legacy Twenty Twelve and Twenty Fourteen, plus popular third-party themes such as Neve, Hestia, and Sydney.
Readable target: a chosen local .php exists on disk. The well-known PEAR pearcmd.php path is the practical RCE transition when register_argc_argv is On. The official php Docker image is affected, and default cPanel with PHP prior to 8.5 is affected.

Affected trains run from WordPress 4.7.0 through 7.1.1. Fixed builds: 7.1.2, 7.0.6, 6.9.9, 6.8.10, and matching backports on every branch down to 4.7.37.

Who is not in scope

WordPress.com and hosts already on fixed builds for your branch (7.1.2 or the backport listed for your major).
Themes without a top-level page-* directory for the LFI-to-RCE path described in the GHSA. Upgrade anyway; the core sink is still patched for a reason.
Installs where no readable attacker-chosen .php exists (and PEAR / register_argc_argv is not available). That lowers immediate RCE odds; it does not cancel the KEV clock or the probing.
The earlier WordPress comment XSS story (CVE-2026-93485 / 7.1.1). Different bug, different fix train. Do not treat a 7.1.1 bump as coverage for 87902.

One operator check

Print the WordPress core version and compare it to the patched build for your branch:

# WP-CLI
wp core version
# or Dashboard → Updates, look for 7.1.2 (or your branch patch: 7.0.6, 6.9.9, 6.8.10, … back to 4.7.37)

Anything below the fixed build on that train is still open for this KEV row. If you run Docker php or cPanel PHP < 8.5 with PEAR present, treat the upgrade as urgent even when you think the theme is “safe.”

How to fix

Upgrade WordPress Core to 7.1.2, or to the security backport on your current major:

wp core update --version=7.1.2
# or update through Dashboard → Updates / your host’s managed WordPress channel

Branch matrix from GHSA-7hp8-65ch-5whp (vulnerable → fixed): 7.1.0–7.1.1 → 7.1.2; 7.0.0–7.0.5 → 7.0.6; 6.9.0–6.9.8 → 6.9.9; 6.8.0–6.8.9 → 6.8.10; continuing with matching patches on every branch back through 4.7.37. Prefer the path you already use (WP-CLI, dashboard, host panel). After the update, re-run wp core version. Federal agencies under BOD 26-04 also owe forensic triage; KEV due date is 2026-09-28.

What this is not

This is not unauthenticated RCE on every default WordPress install with zero preconditions. It is unauthenticated local file inclusion with conditional RCE when the theme has a page-* top-level directory and a readable target such as pearcmd.php is available. Still: CISA KEV today, Patchstack seeing pearcmd write-to-disk attempts, and a three-day federal due date.