# CVE-2026-87902: WordPress - LFI

> Live exploitation tracking for CVE-2026-87902 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-87902

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 8.1
- **Public exploit available:** Yes
- **Affected products:** WordPress
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** wordpress, cms

## Description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

## CrowdSec analysis

[CVE-2026-87902](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-87902) is a high-severity local file inclusion vulnerability in WordPress that allows unauthenticated attackers to cause page-template resolution to include a chosen readable local PHP file outside the active theme directories. Under specific server and theme conditions, successful exploitation could enable remote code execution, potentially leading to unauthorized access, data disclosure, and complete system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of September 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-87902 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-87902 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target the WordPress root endpoint (`/?page_id=...`) using the `pagename` parameter with double URL-encoded directory traversal sequences (`%252F%252E%252E%252F`) to escape theme directories. The traversal attempts to include readable PHP files such as `wp-includes/theme-compat/footer` or `wp-links-opml`, potentially enabling local file disclosure or remote code execution.

## Timeline

- 2026-09-22: CVE Published. CVE-2026-87902 is published to NVD.
- 2026-09-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-87902 for the first time.
- 2026-09-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-87902 exploitation attempts against the CrowdSec Network.
- 2026-09-25: CISA KEV. CVE-2026-87902 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-09-28: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-87902) follows observed exploitation activity for CVE-2026-87902. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.