WordPress Core <= 7.1.1 — Unauthenticated Local File Inclusion via locate_template() Path Traversal

Overview

Advisory ID

CVE-2026-87902

Product

WordPress wordpress

Affected

≤7.1.1

Fixed in

4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2

Weakness

CWE-98 Local File Inclusion

Required access

No account needed

Published

Sep 22, 2026 · updated Nov 13, 2026

Credit

Robert Ressl

Source

Wordfence Intelligence

WordPress Core is vulnerable to Local File Inclusion via the locate_template() function in various versions up to, and including, 7.1.1. The function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, so a template name containing '..' could resolve to a readable PHP file outside the active theme and be included. The core-reachable vector is get_page_template(), which builds page-{$pagename}.php from the URL-derived, url-decoded 'pagename' query variable. This makes it possible for unauthenticated attackers to make page-template resolution include a chosen readable local .php file outside the theme directories, which under certain conditions can lead to remote code execution. Exploitation requires (1) the active parent or child theme to contain a top-level directory whose name begins with 'page-' (e.g. 'page-templates' in Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney), and (2) a readable .php target on the server accessible to the web-server account (e.g. pearcmd.php with register_argc_argv=On, as in the official PHP Docker image and default cPanel setups on PHP < 8.5), which yields RCE.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2
2. Because this CVE is listed in CISA KEV, review the site for signs of compromise: unknown administrator accounts, new PHP files under wp-content/uploads, and unexpected redirects.
3. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.