CISA has added CVE-2026-87902 to its Known Exploited Vulnerabilities (KEV) catalog and set a remediation deadline of September 28, 2026. The flaw is a WordPress Core file inclusion bug that lets an unauthenticated attacker include a local PHP file, and it can lead to remote code execution.
What Is It
CVE-2026-87902 is a file inclusion weakness (CWE-98) in WordPress Core's page-template resolution. According to NVD, an unauthenticated attacker can make get_page_template() include a local .php file of their choosing, as long as the file is readable and sits outside the active theme directories. If certain conditions on both the server and the active theme are met, this can lead to remote code execution (RCE). CISA's KEV entry calls it the "WordPress Core Remote File Inclusion Vulnerability," but NVD's description is of a local file inclusion.
NVD published the CVE on September 22, 2026. Its analysis status is "Undergoing Analysis."
Why It Matters
CISA's KEV catalog confirms active exploitation. CISA added the entry on September 25, 2026. CISA's SSVC assessment rates exploitation as "active" and technical impact as "total."
The CVSS v3.1 base score is 8.1 (HIGH), with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Attackers can reach it over the network without credentials or user interaction. The vector rates attack complexity as high, but the supplied records don't say why. The server and theme conditions NVD lists for RCE may be part of the reason. SSVC rates the flaw as not automatable. A successful attack has high impact on confidentiality, integrity and availability.
The KEV entry also flags the CVE for forensic triage ("Forensics Triage Requirements: Yes"). Whether it has been used in ransomware campaigns is listed as "Unknown."
What's Vulnerable
- Vendor: WordPress
- Product: WordPress Core
- Affected versions: all versions below 7.1.2, per the CNA-supplied affected data in NVD
An unauthenticated attacker can trigger the file inclusion itself as long as the target file is readable and sits outside the active theme directories. Turning that inclusion into remote code execution requires specific server and active-theme conditions. The supplied records do not describe those conditions.
Patch Status
The NVD affected-version data lists WordPress releases below 7.1.2 as vulnerable, so 7.1.2 is the first release outside the affected range. The WordPress security advisory GHSA-7hp8-65ch-5whp has the vendor guidance.
CISA's required action says to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If no mitigations are available, organizations should follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders must also assess each asset's internet exposure and follow BOD 26-04 patching guidelines. The federal due date is September 28, 2026.
Sources
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902
- NVD, CVE-2026-87902: https://nvd.nist.gov/vuln/detail/CVE-2026-87902
- WordPress Security Advisory GHSA-7hp8-65ch-5whp: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- Patchstack: https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements): https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk