An unauthenticated path traversal vulnerability in WordPress Core's page-template resolution allows attackers to include arbitrary local PHP files.
Affected component: WordPress (core)
Fixed in: 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2
Known exploited: this CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 27, 2026. No PowerSEC firewall rule blocks this attack. Update to the fixed release for your branch to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-87902