Loading vulnerability…
Unauthenticated Path Traversal and Local PHP File Inclusion in WordPress Core
CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress Core page-template resolution that permits inclusion of attacker-selected, readable local PHP files outside the active theme directories. A double-encoded traversal value in the public pagename parameter survives initial sanitization and becomes effective when get_page_template() performs an additional URL-decoding operation. With a valid page_id, the request can reach template resolution, where locate_template() and the template loader fail to enforce directory containment. Exploitation depends on the active theme layout and filesystem access; arbitrary code execution additionally requires a suitable local PHP execution gadget or attacker-controlled PHP file. Affected releases begin with WordPress 4.7.0, with branch-specific security fixes including 7.1.2 and backports through 4.7.37.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized inclusion and execution of local PHP files accessible to the PHP/web-server account. Under suitable server conditions, the inclusion can be chained into arbitrary PHP execution, compromising site confidentiality, integrity, and availability. Potential consequences include disclosure of application configuration and database credentials, theft or modification of user and customer records, modification of writable application resources, web-shell deployment, and service disruption. Execution is limited by the service account's permissions; operating-system privilege escalation, root access, and host escape are not inherent consequences.
If you can’t patch tonight, do this now.
Until patched, deploy WAF rules that block encoded traversal in pagename in both query strings and POST bodies, and restrict public access to affected installations where feasible. Disable register_argc_argv in the web-facing PHP runtime and remove unused, web-readable PEAR entry points to interrupt the demonstrated PEAR execution chain. Where operationally safe, remove or rename qualifying top-level page-* directories in active parent and child themes. Restrict PHP filesystem access and write permissions, run the service with least privilege, and segment internet-facing systems from critical assets. Monitor traversal requests, unexpected PHP files, PHP worker child processes, and anomalous outbound connections. These controls do not repair the underlying inclusion flaw or replace updating; restricting administrative interfaces alone does not prevent exploitation through anonymous frontend requests.
Patch, then assume compromise.
Upgrade every affected WordPress installation to a vendor-fixed release, preferably the latest maintained release. Branch-specific fixes include WordPress 7.1.2, 7.0.6, 6.9.9, 6.8.10, and security backports for older branches down to 4.7.37. Do not treat every version below 7.1.2 as vulnerable, because older branches have patched releases. For Debian 13, install wordpress 6.8.10+dfsg1-0+deb13u1 or a later fixed package; use the applicable fixed distributor package on other platforms. Verify deployment across production, staging, and container images. The fix validates decoded page names and enforces approved-directory containment during template resolution. Investigate previously exposed installations for unauthorized PHP files, accounts, application changes, and suspicious execution; patching does not remove an existing compromise.
16 exploits validated by Mallory's analysis. Hidden: 12 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
349 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.