CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Attackers probed unauthenticated WordPress LFI CVE-2026-87902 within hours of the 7.1.2 patch.
Patchstack reports active probing of CVE-2026-87902, an unauthenticated local file inclusion in WordPress page template resolution, rated CVSS 9.2. The flaw affects WordPress 4.7.0 through 7.1.1 and is fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10, and backports to 4.7.37. First probes arrived at 17:44 UTC on 22 September 2026, under five hours after the patch, using double-encoded traversal that matches the diff. Observed requests only include core files such as wp-links-opml.php as an oracle and have not yet targeted code-execution paths such as pearcmd.php.
- Unauthenticated path traversal to local file inclusion, CVSS 9.2
- Probing began less than five hours after WordPress 7.1.2
- Payloads use double-encoded traversal plus a valid page_id
- Seen requests are reconnaissance oracles, not remote code execution yet
- Patch affected branches, with backports through WordPress 4.7.37
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- Patchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
6 min read at patchstack.com
Earlier today we wrote up CVE-2026-87902, the unauthenticated local file inclusion in WordPress page template resolution fixed in 7. 1. 2.
By Dave Jong · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.