Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-87902, a path traversal issue in WordPress's page-template resolution, could lead to Remote Code Execution (RCE). The analysis of the provided patch (commit 9c4e852f2699104a3bf59d35a3b3f55b2e91ccb6) clearly indicates that the get_page_template() and locate_template() functions in src/wp-includes/template.php were the primary points of vulnerability.\n\n1. get_page_template(): This function was directly processing the pagename parameter. Specifically, it would urldecode() the $pagename and then use this decoded value to construct template file paths. The absence of proper validation on this decoded string allowed an attacker to inject path traversal sequences (e.g., ../) to break out of the intended theme directories and attempt to include arbitrary local .php files. The patch addresses this by adding a validate_file() check to the decoded pagename.\n\n2. locate_template(): This function, which is a core part of WordPress's template loading mechanism and is utilized by get_page_template(), was also vulnerable. It would construct file paths based on the $template_name and check for their existence using file_exists(). However, it lacked sufficient checks to prevent path traversal. An attacker could craft a $template_name that, when combined with the base theme paths, would resolve to a file outside the theme's intended scope. The fix introduces a new helper function, _wp_is_template_path_allowed(), which is called within locate_template() to rigorously validate the candidate template path. This new function checks for .. sequences and ensures that the resolved real path of the template file is strictly within the allowed WordPress or theme directories.\n\nTherefore, during an exploitation attempt, an attacker would manipulate the input that eventually feeds into get_page_template() and subsequently locate_template(). These functions, in their vulnerable state, would then process the malicious input, leading to the inclusion of an unintended local .php file, which under certain server configurations, could result in RCE.
get_page_templatesrc/wp-includes/template.php
locate_templatesrc/wp-includes/template.php