Critical WordPress Path Traversal Vulnerability (CVE-2026-87902) Under Active Exploitation

What Happened

A critical security defect affecting WordPress page-template resolution, designated as CVE-2026-87902, has come under active exploitation within hours of public disclosure. Carrying a CVSS score of 9.2, the vulnerability is a path traversal flaw that impacts unauthenticated remote attackers under specific environmental preconditions.

Impact & Mechanics

The flaw stems from how the get_page_template() function resolves page templates, potentially permitting the inclusion of local PHP files located outside designated active theme directories. Successful exploitation requires specific environmental parameters:

• The top-level directory name of the active parent or child theme must begin with page-.
• The web server process account must possess read access to a target local PHP file on the host.
• Attackers have reportedly combined this flaw with techniques such as the pearcmd.php PEAR-to-RCE vector when PHP's register_argc_argv directive is enabled.

"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories." — WordPress Security Advisory

What to Do

Defenders and system administrators managing WordPress deployments should act promptly to mitigate risk:

• Apply official vendor patches or updates immediately as released by WordPress.
• Review active theme directory naming conventions to ensure top-level folders do not start with page-.
• Verify PHP configuration directives on the server, specifically ensuring register_argc_argv is disabled where possible.
• Monitor web server access and error logs for suspicious path traversal attempts or unauthorized inclusion of local files.