Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-87902 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-25 |
| Vendor | WordPress |
| Product | Core |
| CVSS Score | 8.1 (high) |
| EPSS Score | 2.9% (percentile: 86%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-28 |
Vulnerability Description
WordPress Core contains a file inclusion vulnerability (CWE-98). An unauthenticated attacker can make page-template resolution (get_page_template()) include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to remote code execution (RCE).
According to Patchstack, attackers started probing WordPress sites within hours of the patch release.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
In practice: update WordPress Core to the latest security release on every site (including landing pages, blogs and campaign sites outside the main website) and make sure automatic minor-release updates are enabled. On sites that cannot be updated immediately, review web server logs for unusual requests to pages with template parameters.
Who Is Affected?
This vulnerability affects WordPress Core itself (not a plugin), so it covers every unpatched installation — corporate websites, blogs, career portals and marketing campaign sites. Such sites are often maintained by external agencies outside the IT inventory; confirm who is responsible for updating each of them.
Sources
- NVD - CVE-2026-87902
- WordPress - GHSA-7hp8-65ch-5whp
- Patchstack - CVE-2026-87902 analysis
- CISA KEV Catalog
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
