onyx --cves cve-2026-87902
CVE-2026-87902
- score
- 38.3
- cvss
- —
- epss
- 40.0%
- published
- —
- kev added
- 2026-09-25
- first seen
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Added to CISA KEV
- EPSS ≥ 10 % from 2.9 %
- First advisory — Wordfence (WordPress) Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
- Tracked by Onyx
- Nuclei template WordPress Core - PHP Template Path Traversal
Nuclei template
A verified check exists — you can scan for this today, and so can everyone else.
- template
- WordPress Core - PHP Template Path Traversal
- severity
- CRIT
- first seen
nuclei -id CVE-2026-87902 -u https://target.exampleAdvisories
0 feeds this week
Weaknesses
References 4
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-87902