Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe

WordPress Core

WordPress Core

Vendor: WordPress.org · Ecosystem: wordpress-core · wordpress

Briefings

HIGH
7.8
WordPress · Synthesized by AI from 2 sources · 2 weeks ago Actively exploited WordPress Core Local File Inclusion Flaw Allows Remote Code Execution (CVE-2026-87902) A vulnerability in WordPress Core's get_page_template() function allows an unauthenticated attacker to include an arbitrary readable local PHP file outside the active theme directory, which can lead to remote code execution under certain server and theme conditions. Patches are available across all supported WordPress release branches.

Latest advisories

ID Severity Affected versions Fix available
CVE-2026-87902 High · 7.8 introduced 0, fixed 4.7.37 | introduced 4.8, fixed 4.8.32 4.7.37, 4.8.32, 4.9.33
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases are grouped into one email.

Subscribe →

✓ Choose stacks and topics ✓ Change preferences anytime ✓ One grouped email