Critical Local File Inclusion Vulnerability in WordPress Core

• •CVE-2026-87902 allows unauthenticated local file inclusion in WordPress Core.
• •All versions up to 7.1.1 are affected; patch available in version 7.1.2.
• •Exploitation can lead to remote code execution under specific conditions.

A critical vulnerability (CVE-2026-87902) has been discovered in WordPress Core, affecting all versions up to 7.1.1. This flaw allows unauthenticated local file inclusion via the locate_template() function, potentially leading to remote code execution under specific conditions. The vulnerability arises from improper handling of the `pagename` parameter, which can be exploited to include arbitrary PHP files. WordPress has released a patch (version 7.1.2) to address this issue, and users are urged to update immediately. Proof-of-concept code has been verified, and the vulnerability has a CVSS score of 9.2, indicating critical severity. Attackers can exploit this flaw without authentication, making it particularly dangerous for WordPress installations. The vulnerability was disclosed on September 22, 2026, and is confirmed to be exploitable in the wild.