A critical security vulnerability in WordPress could allow an unauthenticated attacker to abuse page-template resolution to include a locally accessible PHP file outside the active theme directory, potentially leading to remote code execution (RCE) under specific server and theme configurations. The vulnerability, tracked as CVE-2026-87902 and identified
Read More