8.1
Élevée
Exploitée
CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-98
Description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WordPress 7.1 | premières → < 7.1.2 | 7.1.2 |
Références
- github.com github.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de WordPress
Les 19 CVE de WordPress →
CVE-2026-65640
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level…
8.8
Élevée
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen
8.9
Élevée
CVE-2026-63030
WordPress Core Interpretation Conflict Vulnerability
9.8
Critique
CVE-2026-60137
WordPress Core SQL Injection Vulnerability
5.9
Moyenne