WordPress Core Remote File Inclusion Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/09/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| wordpress | ≥ 4.8, < 4.8.32≥ 4.9, < 4.9.33≥ 5.0, < 5.0.29≥ 5.1, < 5.1.26≥ 5.2, < 5.2.28≥ 5.3, < 5.3.25≥ 5.4, < 5.4.23≥ 5.5, < 5.5.22≥ 5.6, < 5.6.21≥ 5.7, < 5.7.19≥ 5.8, < 5.8.17≥ 5.9, < 5.9.18≥ 6.0, < 6.0.16≥ 6.1, < 6.1.14≥ 6.2, < 6.2.13≥ 6.3, < 6.3.12≥ 6.4, < 6.4.12≥ 6.5, < 6.5.12≥ 6.6, < 6.6.9≥ 6.7, < 6.7.9≥ 6.8, < 6.8.10≥ 6.9, < 6.9.9≥ 7.0, < 7.0.6≥ 7.1, < 7.1.2< 4.7.37 | 4.8.324.9.335.0.295.1.265.2.285.3.255.4.235.5.225.6.215.7.195.8.175.9.186.0.166.1.146.2.136.3.126.4.126.5.126.6.96.7.96.8.106.9.97.0.67.1.24.7.37 |
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free