WordPress Core is vulnerable to Local File Inclusion via the locate_template() function in various versions up to, and including, 7.1.1.
| CVE | [CVE-2026-87902]( · [CVE.org]( |
| CWE | [CWE-98]( |
| CVSS | **High: 8.1** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Product | [WordPress Core]( |
| Affected | all versions **through 7.1.1** (inclusive) |
| Auth | unauthenticated (see source map) |
| License | [GNU Affero GPL v3.0](LICENSE) |
| Lab | `127.0.0.1` only · vendor/client disclosure pack, not a scanner |
wp-includes/template.php get_page_template + locate_template on 7.1.1. Patch 7.1.2 _wp_is_template_path_allowed and validate_file on decoded pagename.
- **Path:** `/?page_id={id}&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Fuploads%252Fghsa7hp8-witness`
- **Router:** Unauthenticated front-end page query. get_page_template() builds page-{$pagename}.php from urldecoded pagename. locate_template() concatenates onto the theme directory without a jail.
- **Notes:** CVE-2026-87902 CWE-98 WordPress &pagename= `
- `WP_Query parse_query is_page from page_id; get_posts replaces WHERE with ID=page_id`
- `get_page_template urldecode pagename then page-{$pagename}.php`
- `locate_template file_exists(stylesheet_path + '/' + template_name) no jail`
- WordPress 7.1.1 (or any affected branch before the 7.1.2 backports)
- classic theme with a top-level directory named page-* (page-templates)
- readable local .php target (lab: wp-content/uploads/ghsa7hp8-witness.php)
Unauthenticated 200 body contains GHSA7HP8-WITNESS and wp_version=7.1.1. Control GET /?page_id=N does not.
- witness only on a direct GET of the uploads PHP file (wp_version=none)
**Do this first:** Update **WordPress Core** to **7.1.2 or newer**.
- Re-run `CVE-2026-87902-Abraxas-Labs.py` against the patched build: the mapped witness must **not** appear.
- Confirm the vendor advisory / changeset in the deployed tree (see references).
- Disable or isolate the affected component.
- Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).
Target **only** ` (or the loopback you bound). Do not point this script at the internet.
Success is the **witness** above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a `Dockerfile` in this folder builds from source.
- [`lab/docker-compose.yml`](lab/docker-compose.yml)
Bind the vulnerable product tree to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except `127.0.0.1`.
- [CVE-2026-87902 · NVD](
- [CVE-2026-87902 · CVE.org](
- [github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp](
- [
- [
- Abraxas Labs: [abraxaslabs.tech]( · [github.com/abraxas]( · [@abraxas_null](
CVSS: High 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (Wordfence). GitHub advisory: Critical.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. `locate_template()` in WordPress
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
