WordPress security advisory (AV26-952)
WordPress before 7.1.2 is under active attack via CVE-2026-87902, an unauthenticated path traversal that can yield remote code execution.
The Canadian Centre for Cyber Security issued advisory AV26-952 on September 23, 2026, for WordPress versions before 7.1.2. CVE-2026-87902 is an unauthenticated path traversal in page-template resolution that can lead to conditional remote code execution. Open-source reporting indicates the vulnerability is being exploited in the wild. The centre urges administrators to review the linked WordPress materials and apply updates.
- CVE-2026-87902 affects WordPress versions before 7.1.2.
- Unauthenticated path traversal in template resolution can yield conditional RCE.
- Open-source reporting says the flaw is being exploited.
- The Canadian Cyber Centre urges administrators to update.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-952 Date: September 23, 2026 As of September 22, 2026, WordPress is affected by a vulnerability in the following product: WordPress Prior to 7. 1. 2 Open-source reporting indicates that CVE-2026-87902 is being exploited in the wild.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.