In plain words
Think of a website like a house with many doors and locks. This flaw is like a weak lock that can be easily picked by someone who does not even have a key¹.
What's broken
The specific bug is a vulnerability in WordPress, known as CVE-2026-87902², which has a high severity score of 9.2. An attacker can use this flaw to get remote code execution (RCE)³, which means they can run their own code on the website without being authenticated⁴.
How it actually works
Here's how it works: an attacker can make the website include a local .php file that they choose, which allows them to run their own code. This is possible because the get_page_template() function is not properly restricted, so an attacker can use it to access files they should not be able to access. This is a problem because it lets an attacker run code on the website without needing to log in, which is what remote code execution (RCE)³ means.
Proof of concept
A proof of concept (PoC)⁵ is not described in detail in the source, but the fact that attackers began exploiting the flaw within hours of its disclosure suggests that a PoC may exist. A PoC is a demonstration that the flaw is real and can be exploited, which raises the urgency of the issue.
Is it real
It is clear that this vulnerability is being actively exploited in the wild, as attackers began using it within hours of its disclosure. The limiting factor is that the website must be running a vulnerable version of WordPress.
What to do
To fix this issue, users should update their WordPress version to a patched version, which should prevent attackers from exploiting this flaw.
Terms
- ¹ key
- , A key is a piece of information used to access a locked system, like a password or a physical key.
- ² CVE
- , A CVE is a unique identifier for a security vulnerability, which helps track and discuss the issue.
- ³ RCE
- , RCE means an attacker can run their own code on a system, which can lead to a full takeover of the system.
- ⁴ unauthenticated
- , An unauthenticated attacker is someone who does not have a valid username and password to access a system.
- ⁵ PoC
- , A PoC is a demonstration that a security flaw is real and can be exploited, often by showing how an attacker could use it.