WordPress Core get_page_template() Local File Inclusion (CVE-2026-87902) - Version Fingerprint

Could this high WordPress vulnerability affect your website?

WordPress core's get_page_template() page-template resolution logic can be abused by an unauthenticated attacker to make the resolver include a chosen readable local .php file located outside the active theme's directories. Under specific server and active-theme preconditions this can escalate to remote code execution (GHSA-7hp8-65ch-5whp). The public advisory does not disclose a distinguishing, safely-probeable HTTP request/response signature for the vulnerable code path itself — reproducing the file-inclusion primitive would constitute exploitation rather than detection and is out of scope for this template. This template instead performs a safe, non-destructive fingerprint of the exposed WordPress version (via the HTML generator meta tag and the RSS/Atom feed generator tag) so that matching hosts can be flagged for manual verification of their patch level against the referenced advisory. A match indicates a WordPress installation whose version should be checked against the fix for CVE-2026-87902; it does NOT confirm the target is actually exploitable.

Enter a domain you own and we will test it right now — and, while we are there, report anything else it exposes publicly. No account, no agent to install.