WordPress CVE-2026-87902

Exploitation targets WordPress core's get_page_template() page-template resolution and requires the attacker to influence which .php file is included so that a readable local file outside the active theme directories is loaded. Per the description, RCE only follows 'if relevant pre-conditions for both the server and the active theme are met' - i.e., it is gated on both server configuration and the active theme's behavior, which is why CVSS assigns AC:H despite PR:N/UI:N. Limiting factors: the attacker needs a suitable readable local .php file that produces code execution when included, and the specific (unstated) server + active-theme conditions must hold; on hardened or non-matching configurations the impact may degrade to local file inclusion / information disclosure rather than full RCE. No authentication or user interaction is required (PR:N, UI:N).

This is a WordPress core issue (per the WordPress/wordpress-develop GHSA-7hp8-65ch-5whp advisory), affecting the get_page_template() page-template resolution path. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) reflects an unauthenticated network-reachable flaw with full CIA impact - consistent with the description's claim that it can escalate from local file inclusion (CWE-98) to RCE. The critical counterweight is AC:H, which aligns with the description's explicit gating: 'If relevant pre-conditions for both the server and the active theme are met.' No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The net picture is a high-severity-on-paper flaw whose real-world exploitability is materially constrained: an attacker must find a readable local .php file that is exploitable when included, and the target must run a server and active theme meeting unstated preconditions. Because WordPress is ubiquitous, even a low exploitation rate translates to a large absolute attack surface, so patching should be prioritized, but the AC:H gating argues this is more opportunistic/target-dependent than a mass-exploitation candidate. Missing signal: the exact server/theme preconditions and whether a reliable RCE gadget is publicly known - verify against the WordPress advisory before assuming trivial exploitability.

An unauthenticated attacker sends a crafted request that influences page-template resolution in get_page_template(), coercing WordPress to include a chosen readable local .php file outside the active theme directories. On a server and active theme meeting the required preconditions, the included file executes attacker-influenced PHP, yielding remote code execution. No public exploit code is identified at time of analysis, and the AC:H rating indicates non-trivial preconditions must line up.