Full Report
A vulnerability has been discovered in WordPress that could allow arbitrary code on the web server. WordPress is a free, open-source content management system (CMS) that allows you to build and manage websites without needing to write code. Successful exploitation allows an unauthenticated attacker to manipulate the page-template resolution logic to execute local PHP files outside the active theme directory, potentially leading to Remote Code Execution (RCE) under specific conditions.
Analysis Summary
# Vulnerability: WordPress Page-Template Resolution Remote Code Execution (RCE)
## CVE Details
- **CVE ID:** CVE-2026-87902
- **CVSS Score:** Not explicitly listed in text, but categorized as **HIGH** risk for government and business entities.
- **CWE:** CWE-94 (Improper Control of Generation of Code / Code Injection) or CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), inferred from technical summary.
## Affected Systems
- **Products:** WordPress Content Management System (CMS).
- **Versions:** All versions prior to **7.1.2**.
- **Configurations:** Systems where the server and active theme meet specific pre-conditions allowing for local file inclusion and execution.
## Vulnerability Description
The flaw exists within the `get_page_template()` function responsible for page-template resolution. An unauthenticated attacker can manipulate the logic to force the application to include and execute a readable local `.php` file located outside of the active theme directory. If an attacker can successfully point this logic to a file containing malicious code (or a file they have previously uploaded/influenced), it leads to arbitrary code execution on the web server.
## Exploitation
- **Status:** **Exploited in the wild.** CISA has added this to its Known Exploited Vulnerabilities (KEV) Catalog.
- **Complexity:** Medium (requires specific server/theme pre-conditions).
- **Attack Vector:** Network (Remote, Unauthenticated).
## Impact
- **Confidentiality:** High (Full access to server files and database).
- **Integrity:** High (Ability to modify website content and server configuration).
- **Availability:** High (Potential for site defacement or total service shutdown).
## Remediation
### Patches
- **WordPress 7.1.2:** Users should update to this version immediately.
- Updates from third-party vendors who bundle or use WordPress should also be applied.
### Workarounds
- **Principle of Least Privilege:** Run the web server software as a non-privileged user to limit the impact of code execution.
- **Exploit Protection:** Enable anti-exploitation features such as Data Execution Prevention (DEP).
## Detection
- **Indicators of Compromise:** Review web server access logs for unusual requests involving the manipulation of template parameters or calls to `get_page_template()` referencing paths outside the `/wp-content/themes/` directory.
- **Detection methods and tools:**
- Perform automated vulnerability scans (authenticated and unauthenticated) using SCAP-compliant tools.
- Conduct periodic external penetration testing to identify exploitable entry points.
## References
- **Vendor Advisory:** hxxps[://]wordpress[.]org/news/2026/09/wordpress-7-1-2-release/
- **CVE Mitre:** hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2026-87902
- **Kaspersky Analysis:** hxxps[://]www[.]kaspersky[.]com/blog/cve-2026-87902-wordpress-vulnerability/56459/
- **MS-ISAC Advisory:** 2026-106