WordPress Vulnerabilities

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description

WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on the server environment.

Affects WordPress

7.1.1
Fixed in WordPress 7.1.2
7.1.0
Fixed in WordPress 7.1.2
7.1
Fixed in WordPress 7.1.2
7.0.5
Fixed in WordPress 7.0.6
7.0.4
Fixed in WordPress 7.0.6
7.0.3
Fixed in WordPress 7.0.6
7.0.2
Fixed in WordPress 7.0.6
7.0.1
Fixed in WordPress 7.0.6
7.0.0
Fixed in WordPress 7.0.6
7.0
Fixed in WordPress 7.0.6
6.9.8
Fixed in WordPress 6.9.9
6.9.7
Fixed in WordPress 6.9.9
6.9.6
Fixed in WordPress 6.9.9
6.9.5
Fixed in WordPress 6.9.9
6.9.4
Fixed in WordPress 6.9.9
6.9.3
Fixed in WordPress 6.9.9
6.9.2
Fixed in WordPress 6.9.9
6.9.1
Fixed in WordPress 6.9.9
6.9.0
Fixed in WordPress 6.9.9
6.9
Fixed in WordPress 6.9.9
6.8.9
Fixed in WordPress 6.8.10
6.8.8
Fixed in WordPress 6.8.10
6.8.7
Fixed in WordPress 6.8.10
6.8.6
Fixed in WordPress 6.8.10
6.8.5
Fixed in WordPress 6.8.10
6.8.4
Fixed in WordPress 6.8.10
6.8.3
Fixed in WordPress 6.8.10
6.8.2
Fixed in WordPress 6.8.10
6.8.1
Fixed in WordPress 6.8.10
6.8.0
Fixed in WordPress 6.8.10
6.8
Fixed in WordPress 6.8.10
6.7.8
Fixed in WordPress 6.7.9
6.7.7
Fixed in WordPress 6.7.9
6.7.6
Fixed in WordPress 6.7.9
6.7.5
Fixed in WordPress 6.7.9
6.7.4
Fixed in WordPress 6.7.9
6.7.3
Fixed in WordPress 6.7.9
6.7.2
Fixed in WordPress 6.7.9
6.7.1
Fixed in WordPress 6.7.9
6.7.0
Fixed in WordPress 6.7.9
6.7
Fixed in WordPress 6.7.9
6.6.8
Fixed in WordPress 6.6.9
6.6.7
Fixed in WordPress 6.6.9
6.6.6
Fixed in WordPress 6.6.9
6.6.5
Fixed in WordPress 6.6.9
6.6.4
Fixed in WordPress 6.6.9
6.6.3
Fixed in WordPress 6.6.9
6.6.2
Fixed in WordPress 6.6.9
6.6.1
Fixed in WordPress 6.6.9
6.6.0
Fixed in WordPress 6.6.9
6.6
Fixed in WordPress 6.6.9
6.5.11
Fixed in WordPress 6.5.12
6.5.10
Fixed in WordPress 6.5.12
6.5.9
Fixed in WordPress 6.5.12
6.5.8
Fixed in WordPress 6.5.12
6.5.7
Fixed in WordPress 6.5.12
6.5.6
Fixed in WordPress 6.5.12
6.5.5
Fixed in WordPress 6.5.12
6.5.4
Fixed in WordPress 6.5.12
6.5.3
Fixed in WordPress 6.5.12
6.5.2
Fixed in WordPress 6.5.12
6.5.1
Fixed in WordPress 6.5.12
6.5.0
Fixed in WordPress 6.5.12
6.5
Fixed in WordPress 6.5.12
6.4.11
Fixed in WordPress 6.4.12
6.4.10
Fixed in WordPress 6.4.12
6.4.9
Fixed in WordPress 6.4.12
6.4.8
Fixed in WordPress 6.4.12
6.4.7
Fixed in WordPress 6.4.12
6.4.6
Fixed in WordPress 6.4.12
6.4.5
Fixed in WordPress 6.4.12
6.4.4
Fixed in WordPress 6.4.12
6.4.3
Fixed in WordPress 6.4.12
6.4.2
Fixed in WordPress 6.4.12
6.4.1
Fixed in WordPress 6.4.12
6.4.0
Fixed in WordPress 6.4.12
6.4
Fixed in WordPress 6.4.12
6.3.11
Fixed in WordPress 6.3.12
6.3.10
Fixed in WordPress 6.3.12
6.3.9
Fixed in WordPress 6.3.12
6.3.8
Fixed in WordPress 6.3.12
6.3.7
Fixed in WordPress 6.3.12
6.3.6
Fixed in WordPress 6.3.12
6.3.5
Fixed in WordPress 6.3.12
6.3.4
Fixed in WordPress 6.3.12
6.3.3
Fixed in WordPress 6.3.12
6.3.2
Fixed in WordPress 6.3.12
6.3.1
Fixed in WordPress 6.3.12
6.3.0
Fixed in WordPress 6.3.12
6.3
Fixed in WordPress 6.3.12
6.2.12
Fixed in WordPress 6.2.13
6.2.11
Fixed in WordPress 6.2.13
6.2.10
Fixed in WordPress 6.2.13
6.2.9
Fixed in WordPress 6.2.13
6.2.8
Fixed in WordPress 6.2.13
6.2.7
Fixed in WordPress 6.2.13
6.2.6
Fixed in WordPress 6.2.13
6.2.5
Fixed in WordPress 6.2.13
6.2.4
Fixed in WordPress 6.2.13
6.2.3
Fixed in WordPress 6.2.13
6.2.2
Fixed in WordPress 6.2.13
6.2.1
Fixed in WordPress 6.2.13
6.2.0
Fixed in WordPress 6.2.13
6.2
Fixed in WordPress 6.2.13
6.1.13
Fixed in WordPress 6.1.14
6.1.12
Fixed in WordPress 6.1.14
6.1.11
Fixed in WordPress 6.1.14
6.1.10
Fixed in WordPress 6.1.14
6.1.9
Fixed in WordPress 6.1.14
6.1.8
Fixed in WordPress 6.1.14
6.1.7
Fixed in WordPress 6.1.14
6.1.6
Fixed in WordPress 6.1.14
6.1.5
Fixed in WordPress 6.1.14
6.1.4
Fixed in WordPress 6.1.14
6.1.3
Fixed in WordPress 6.1.14
6.1.2
Fixed in WordPress 6.1.14
6.1.1
Fixed in WordPress 6.1.14
6.1.0
Fixed in WordPress 6.1.14
6.1
Fixed in WordPress 6.1.14
6.0.15
Fixed in WordPress 6.0.16
6.0.14
Fixed in WordPress 6.0.16
6.0.13
Fixed in WordPress 6.0.16
6.0.12
Fixed in WordPress 6.0.16
6.0.11
Fixed in WordPress 6.0.16
6.0.10
Fixed in WordPress 6.0.16
6.0.9
Fixed in WordPress 6.0.16
6.0.8
Fixed in WordPress 6.0.16
6.0.7
Fixed in WordPress 6.0.16
6.0.6
Fixed in WordPress 6.0.16
6.0.5
Fixed in WordPress 6.0.16
6.0.4
Fixed in WordPress 6.0.16
6.0.3
Fixed in WordPress 6.0.16
6.0.2
Fixed in WordPress 6.0.16
6.0.1
Fixed in WordPress 6.0.16
6.0.0
Fixed in WordPress 6.0.16
6.0
Fixed in WordPress 6.0.16
5.9.17
Fixed in WordPress 5.9.18
5.9.16
Fixed in WordPress 5.9.18
5.9.15
Fixed in WordPress 5.9.18
5.9.14
Fixed in WordPress 5.9.18
5.9.13
Fixed in WordPress 5.9.18
5.9.12
Fixed in WordPress 5.9.18
5.9.11
Fixed in WordPress 5.9.18
5.9.10
Fixed in WordPress 5.9.18
5.9.9
Fixed in WordPress 5.9.18
5.9.8
Fixed in WordPress 5.9.18
5.9.7
Fixed in WordPress 5.9.18
5.9.6
Fixed in WordPress 5.9.18
5.9.5
Fixed in WordPress 5.9.18
5.9.4
Fixed in WordPress 5.9.18
5.9.3
Fixed in WordPress 5.9.18
5.9.2
Fixed in WordPress 5.9.18
5.9.1
Fixed in WordPress 5.9.18
5.9.0
Fixed in WordPress 5.9.18
5.9
Fixed in WordPress 5.9.18
5.8.16
Fixed in WordPress 5.8.17
5.8.15
Fixed in WordPress 5.8.17
5.8.14
Fixed in WordPress 5.8.17
5.8.13
Fixed in WordPress 5.8.17
5.8.12
Fixed in WordPress 5.8.17
5.8.11
Fixed in WordPress 5.8.17
5.8.10
Fixed in WordPress 5.8.17
5.8.9
Fixed in WordPress 5.8.17
5.8.8
Fixed in WordPress 5.8.17
5.8.7
Fixed in WordPress 5.8.17
5.8.6
Fixed in WordPress 5.8.17
5.8.5
Fixed in WordPress 5.8.17
5.8.4
Fixed in WordPress 5.8.17
5.8.3
Fixed in WordPress 5.8.17
5.8.2
Fixed in WordPress 5.8.17
5.8.1
Fixed in WordPress 5.8.17
5.8.0
Fixed in WordPress 5.8.17
5.8
Fixed in WordPress 5.8.17
5.7.18
Fixed in WordPress 5.7.19
5.7.17
Fixed in WordPress 5.7.19
5.7.16
Fixed in WordPress 5.7.19
5.7.15
Fixed in WordPress 5.7.19
5.7.14
Fixed in WordPress 5.7.19
5.7.13
Fixed in WordPress 5.7.19
5.7.12
Fixed in WordPress 5.7.19
5.7.11
Fixed in WordPress 5.7.19
5.7.10
Fixed in WordPress 5.7.19
5.7.9
Fixed in WordPress 5.7.19
5.7.8
Fixed in WordPress 5.7.19
5.7.7
Fixed in WordPress 5.7.19
5.7.6
Fixed in WordPress 5.7.19
5.7.5
Fixed in WordPress 5.7.19
5.7.4
Fixed in WordPress 5.7.19
5.7.3
Fixed in WordPress 5.7.19
5.7.2
Fixed in WordPress 5.7.19
5.7.1
Fixed in WordPress 5.7.19
5.7.0
Fixed in WordPress 5.7.19
5.7
Fixed in WordPress 5.7.19
5.6.20
Fixed in WordPress 5.6.21
5.6.19
Fixed in WordPress 5.6.21
5.6.18
Fixed in WordPress 5.6.21
5.6.17
Fixed in WordPress 5.6.21
5.6.16
Fixed in WordPress 5.6.21
5.6.15
Fixed in WordPress 5.6.21
5.6.14
Fixed in WordPress 5.6.21
5.6.13
Fixed in WordPress 5.6.21
5.6.12
Fixed in WordPress 5.6.21
5.6.11
Fixed in WordPress 5.6.21
5.6.10
Fixed in WordPress 5.6.21
5.6.9
Fixed in WordPress 5.6.21
5.6.8
Fixed in WordPress 5.6.21
5.6.7
Fixed in WordPress 5.6.21
5.6.6
Fixed in WordPress 5.6.21
5.6.5
Fixed in WordPress 5.6.21
5.6.4
Fixed in WordPress 5.6.21
5.6.3
Fixed in WordPress 5.6.21
5.6.2
Fixed in WordPress 5.6.21
5.6.1
Fixed in WordPress 5.6.21
5.6.0
Fixed in WordPress 5.6.21
5.6
Fixed in WordPress 5.6.21
5.5.21
Fixed in WordPress 5.5.22
5.5.20
Fixed in WordPress 5.5.22
5.5.19
Fixed in WordPress 5.5.22
5.5.18
Fixed in WordPress 5.5.22
5.5.17
Fixed in WordPress 5.5.22
5.5.16
Fixed in WordPress 5.5.22
5.5.15
Fixed in WordPress 5.5.22
5.5.14
Fixed in WordPress 5.5.22
5.5.13
Fixed in WordPress 5.5.22
5.5.12
Fixed in WordPress 5.5.22
5.5.11
Fixed in WordPress 5.5.22
5.5.10
Fixed in WordPress 5.5.22
5.5.9
Fixed in WordPress 5.5.22
5.5.8
Fixed in WordPress 5.5.22
5.5.7
Fixed in WordPress 5.5.22
5.5.6
Fixed in WordPress 5.5.22
5.5.5
Fixed in WordPress 5.5.22
5.5.4
Fixed in WordPress 5.5.22
5.5.3
Fixed in WordPress 5.5.22
5.5.2
Fixed in WordPress 5.5.22
5.5.1
Fixed in WordPress 5.5.22
5.5.0
Fixed in WordPress 5.5.22
5.5
Fixed in WordPress 5.5.22
5.4.22
Fixed in WordPress 5.4.23
5.4.21
Fixed in WordPress 5.4.23
5.4.20
Fixed in WordPress 5.4.23
5.4.19
Fixed in WordPress 5.4.23
5.4.18
Fixed in WordPress 5.4.23
5.4.17
Fixed in WordPress 5.4.23
5.4.16
Fixed in WordPress 5.4.23
5.4.15
Fixed in WordPress 5.4.23
5.4.14
Fixed in WordPress 5.4.23
5.4.13
Fixed in WordPress 5.4.23
5.4.12
Fixed in WordPress 5.4.23
5.4.11
Fixed in WordPress 5.4.23
5.4.10
Fixed in WordPress 5.4.23
5.4.9
Fixed in WordPress 5.4.23
5.4.8
Fixed in WordPress 5.4.23
5.4.7
Fixed in WordPress 5.4.23
5.4.6
Fixed in WordPress 5.4.23
5.4.5
Fixed in WordPress 5.4.23
5.4.4
Fixed in WordPress 5.4.23
5.4.3
Fixed in WordPress 5.4.23
5.4.2
Fixed in WordPress 5.4.23
5.4.1
Fixed in WordPress 5.4.23
5.4.0
Fixed in WordPress 5.4.23
5.4
Fixed in WordPress 5.4.23
5.3.24
Fixed in WordPress 5.3.25
5.3.23
Fixed in WordPress 5.3.25
5.3.22
Fixed in WordPress 5.3.25
5.3.21
Fixed in WordPress 5.3.25
5.3.20
Fixed in WordPress 5.3.25
5.3.19
Fixed in WordPress 5.3.25
5.3.18
Fixed in WordPress 5.3.25
5.3.17
Fixed in WordPress 5.3.25
5.3.16
Fixed in WordPress 5.3.25
5.3.15
Fixed in WordPress 5.3.25
5.3.14
Fixed in WordPress 5.3.25
5.3.13
Fixed in WordPress 5.3.25
5.3.12
Fixed in WordPress 5.3.25
5.3.11
Fixed in WordPress 5.3.25
5.3.10
Fixed in WordPress 5.3.25
5.3.9
Fixed in WordPress 5.3.25
5.3.8
Fixed in WordPress 5.3.25
5.3.7
Fixed in WordPress 5.3.25
5.3.6
Fixed in WordPress 5.3.25
5.3.5
Fixed in WordPress 5.3.25
5.3.4
Fixed in WordPress 5.3.25
5.3.3
Fixed in WordPress 5.3.25
5.3.2
Fixed in WordPress 5.3.25
5.3.1
Fixed in WordPress 5.3.25
5.3.0
Fixed in WordPress 5.3.25
5.3
Fixed in WordPress 5.3.25
5.2.27
Fixed in WordPress 5.2.28
5.2.26
Fixed in WordPress 5.2.28
5.2.25
Fixed in WordPress 5.2.28
5.2.24
Fixed in WordPress 5.2.28
5.2.23
Fixed in WordPress 5.2.28
5.2.22
Fixed in WordPress 5.2.28
5.2.21
Fixed in WordPress 5.2.28
5.2.20
Fixed in WordPress 5.2.28
5.2.19
Fixed in WordPress 5.2.28
5.2.18
Fixed in WordPress 5.2.28
5.2.17
Fixed in WordPress 5.2.28
5.2.16
Fixed in WordPress 5.2.28
5.2.15
Fixed in WordPress 5.2.28
5.2.14
Fixed in WordPress 5.2.28
5.2.13
Fixed in WordPress 5.2.28
5.2.12
Fixed in WordPress 5.2.28
5.2.11
Fixed in WordPress 5.2.28
5.2.10
Fixed in WordPress 5.2.28
5.2.9
Fixed in WordPress 5.2.28
5.2.8
Fixed in WordPress 5.2.28
5.2.7
Fixed in WordPress 5.2.28
5.2.6
Fixed in WordPress 5.2.28
5.2.5
Fixed in WordPress 5.2.28
5.2.4
Fixed in WordPress 5.2.28
5.2.3
Fixed in WordPress 5.2.28
5.2.2
Fixed in WordPress 5.2.28
5.2.1
Fixed in WordPress 5.2.28
5.2.0
Fixed in WordPress 5.2.28
5.2
Fixed in WordPress 5.2.28
5.1.25
Fixed in WordPress 5.1.26
5.1.24
Fixed in WordPress 5.1.26
5.1.23
Fixed in WordPress 5.1.26
5.1.22
Fixed in WordPress 5.1.26
5.1.21
Fixed in WordPress 5.1.26
5.1.20
Fixed in WordPress 5.1.26
5.1.19
Fixed in WordPress 5.1.26
5.1.18
Fixed in WordPress 5.1.26
5.1.17
Fixed in WordPress 5.1.26
5.1.16
Fixed in WordPress 5.1.26
5.1.15
Fixed in WordPress 5.1.26
5.1.14
Fixed in WordPress 5.1.26
5.1.13
Fixed in WordPress 5.1.26
5.1.12
Fixed in WordPress 5.1.26
5.1.11
Fixed in WordPress 5.1.26
5.1.10
Fixed in WordPress 5.1.26
5.1.9
Fixed in WordPress 5.1.26
5.1.8
Fixed in WordPress 5.1.26
5.1.7
Fixed in WordPress 5.1.26
5.1.6
Fixed in WordPress 5.1.26
5.1.5
Fixed in WordPress 5.1.26
5.1.4
Fixed in WordPress 5.1.26
5.1.3
Fixed in WordPress 5.1.26
5.1.2
Fixed in WordPress 5.1.26
5.1.1
Fixed in WordPress 5.1.26
5.1.0
Fixed in WordPress 5.1.26
5.1
Fixed in WordPress 5.1.26
5.0.28
Fixed in WordPress 5.0.29
5.0.27
Fixed in WordPress 5.0.29
5.0.26
Fixed in WordPress 5.0.29
5.0.25
Fixed in WordPress 5.0.29
5.0.24
Fixed in WordPress 5.0.29
5.0.23
Fixed in WordPress 5.0.29
5.0.22
Fixed in WordPress 5.0.29
5.0.21
Fixed in WordPress 5.0.29
5.0.20
Fixed in WordPress 5.0.29
5.0.19
Fixed in WordPress 5.0.29
5.0.18
Fixed in WordPress 5.0.29
5.0.17
Fixed in WordPress 5.0.29
5.0.16
Fixed in WordPress 5.0.29
5.0.15
Fixed in WordPress 5.0.29
5.0.14
Fixed in WordPress 5.0.29
5.0.13
Fixed in WordPress 5.0.29
5.0.12
Fixed in WordPress 5.0.29
5.0.11
Fixed in WordPress 5.0.29
5.0.10
Fixed in WordPress 5.0.29
5.0.9
Fixed in WordPress 5.0.29
5.0.8
Fixed in WordPress 5.0.29
5.0.7
Fixed in WordPress 5.0.29
5.0.6
Fixed in WordPress 5.0.29
5.0.5
Fixed in WordPress 5.0.29
5.0.4
Fixed in WordPress 5.0.29
5.0.3
Fixed in WordPress 5.0.29
5.0.2
Fixed in WordPress 5.0.29
5.0.1
Fixed in WordPress 5.0.29
5.0.0
Fixed in WordPress 5.0.29
5.0
Fixed in WordPress 5.0.29
4.9.32
Fixed in WordPress 4.9.33
4.9.31
Fixed in WordPress 4.9.33
4.9.30
Fixed in WordPress 4.9.33
4.9.29
Fixed in WordPress 4.9.33
4.9.28
Fixed in WordPress 4.9.33
4.9.27
Fixed in WordPress 4.9.33
4.9.26
Fixed in WordPress 4.9.33
4.9.25
Fixed in WordPress 4.9.33
4.9.24
Fixed in WordPress 4.9.33
4.9.23
Fixed in WordPress 4.9.33
4.9.22
Fixed in WordPress 4.9.33
4.9.21
Fixed in WordPress 4.9.33
4.9.20
Fixed in WordPress 4.9.33
4.9.19
Fixed in WordPress 4.9.33
4.9.18
Fixed in WordPress 4.9.33
4.9.17
Fixed in WordPress 4.9.33
4.9.16
Fixed in WordPress 4.9.33
4.9.15
Fixed in WordPress 4.9.33
4.9.14
Fixed in WordPress 4.9.33
4.9.13
Fixed in WordPress 4.9.33
4.9.12
Fixed in WordPress 4.9.33
4.9.11
Fixed in WordPress 4.9.33
4.9.10
Fixed in WordPress 4.9.33
4.9.9
Fixed in WordPress 4.9.33
4.9.8
Fixed in WordPress 4.9.33
4.9.7
Fixed in WordPress 4.9.33
4.9.6
Fixed in WordPress 4.9.33
4.9.5
Fixed in WordPress 4.9.33
4.9.4
Fixed in WordPress 4.9.33
4.9.3
Fixed in WordPress 4.9.33
4.9.2
Fixed in WordPress 4.9.33
4.9.1
Fixed in WordPress 4.9.33
4.9.0
Fixed in WordPress 4.9.33
4.9
Fixed in WordPress 4.9.33
4.8.31
Fixed in WordPress 4.8.32
4.8.30
Fixed in WordPress 4.8.32
4.8.29
Fixed in WordPress 4.8.32
4.8.28
Fixed in WordPress 4.8.32
4.8.27
Fixed in WordPress 4.8.32
4.8.26
Fixed in WordPress 4.8.32
4.8.25
Fixed in WordPress 4.8.32
4.8.24
Fixed in WordPress 4.8.32
4.8.23
Fixed in WordPress 4.8.32
4.8.22
Fixed in WordPress 4.8.32
4.8.21
Fixed in WordPress 4.8.32
4.8.20
Fixed in WordPress 4.8.32
4.8.19
Fixed in WordPress 4.8.32
4.8.18
Fixed in WordPress 4.8.32
4.8.17
Fixed in WordPress 4.8.32
4.8.16
Fixed in WordPress 4.8.32
4.8.15
Fixed in WordPress 4.8.32
4.8.14
Fixed in WordPress 4.8.32
4.8.13
Fixed in WordPress 4.8.32
4.8.12
Fixed in WordPress 4.8.32
4.8.11
Fixed in WordPress 4.8.32
4.8.10
Fixed in WordPress 4.8.32
4.8.9
Fixed in WordPress 4.8.32
4.8.8
Fixed in WordPress 4.8.32
4.8.7
Fixed in WordPress 4.8.32
4.8.6
Fixed in WordPress 4.8.32
4.8.5
Fixed in WordPress 4.8.32
4.8.4
Fixed in WordPress 4.8.32
4.8.3
Fixed in WordPress 4.8.32
4.8.2
Fixed in WordPress 4.8.32
4.8.1
Fixed in WordPress 4.8.32
4.8.0
Fixed in WordPress 4.8.32
4.8
Fixed in WordPress 4.8.32
4.7.36
Fixed in WordPress 4.7.37
4.7.35
Fixed in WordPress 4.7.37
4.7.34
Fixed in WordPress 4.7.37
4.7.33
Fixed in WordPress 4.7.37
4.7.32
Fixed in WordPress 4.7.37
4.7.31
Fixed in WordPress 4.7.37
4.7.30
Fixed in WordPress 4.7.37
4.7.29
Fixed in WordPress 4.7.37
4.7.28
Fixed in WordPress 4.7.37
4.7.27
Fixed in WordPress 4.7.37
4.7.26
Fixed in WordPress 4.7.37
4.7.25
Fixed in WordPress 4.7.37
4.7.24
Fixed in WordPress 4.7.37
4.7.23
Fixed in WordPress 4.7.37
4.7.22
Fixed in WordPress 4.7.37
4.7.21
Fixed in WordPress 4.7.37
4.7.20
Fixed in WordPress 4.7.37
4.7.19
Fixed in WordPress 4.7.37
4.7.18
Fixed in WordPress 4.7.37
4.7.17
Fixed in WordPress 4.7.37
4.7.16
Fixed in WordPress 4.7.37
4.7.15
Fixed in WordPress 4.7.37
4.7.14
Fixed in WordPress 4.7.37
4.7.13
Fixed in WordPress 4.7.37
4.7.12
Fixed in WordPress 4.7.37
4.7.11
Fixed in WordPress 4.7.37
4.7.10
Fixed in WordPress 4.7.37
4.7.9
Fixed in WordPress 4.7.37
4.7.8
Fixed in WordPress 4.7.37
4.7.7
Fixed in WordPress 4.7.37
4.7.6
Fixed in WordPress 4.7.37
4.7.5
Fixed in WordPress 4.7.37
4.7.4
Fixed in WordPress 4.7.37
4.7.3
Fixed in WordPress 4.7.37
4.7.2
Fixed in WordPress 4.7.37
4.7.1
Fixed in WordPress 4.7.37
4.7.0
Fixed in WordPress 4.7.37
4.7
Fixed in WordPress 4.7.37

References

CVE
CVE-2026-87902
URL
https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Robert Ressl
Verified
Yes
WPVDB ID
507ae4f0-6fb3-4efa-87fc-5b9b1df912c7

Timeline

Publicly Published
2026-09-22 (about 1 month ago)
Added
2026-09-23 (about 1 month ago)
Last Updated
2026-09-23 (about 1 month ago)

Other

Published
Title
Published
2026-07-08
Title
SureDash – Community, Courses & Member Dashboard < 1.8.1 - Authenticated (SureDash User+) Arbitrary File Deletion
Published
2014-08-01
Title
WP Custom Pages 0.5.0.1 - LFI
Published
2026-10-01
Title
MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import
Published
2024-07-08
Title
Panda Video < 1.4.1 - Authenticated (Contributor+) Local File Inclusion
Published
2026-08-14
Title
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels < 6.6.48 - Authenticated (Shop Manager+) Arbitrary File Downloaf