A critical vulnerability, identified as CVE-2026-87902, has been discovered in WordPress Core. The vulnerability is caused by improper validation during page-template resolution and could allow an unauthenticated remote attacker to include a readable local PHP file located outside the active WordPress theme directories. Under certain server and theme configurations, successful exploitation could lead to remote code execution and complete compromise of the affected website.

WordPress has released security updates to address the vulnerabilities. System owners are strongly recommended to verify their installed WordPress version and update to the latest version (7.1.2 or later) immediately.

For details, please visit:

• WordPress Local File Inclusion to Remote Code Execution Vulnerability (CVE-2026-87902)
• Information Security Alerts