U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited WordPress Core flaw CVE-2026-87902 to the Known Exploited Vulnerabilities catalog.
CISA added WordPress Core flaw CVE-2026-87902, CVSS 9.2, to its Known Exploited Vulnerabilities catalog. An unauthenticated attacker can make get_page_template() include a readable local PHP file outside the active theme, and under specific server and theme conditions that can become remote code execution. The vulnerability is being exploited, with attackers using pearcmd.php to write malicious PHP and run code. WordPress 7.1.2 fixes the bug, present since 4.7.0, and CISA directed federal agencies to remediate it by September 24, 2026.
- CVE-2026-87902 is an unauthenticated WordPress Core flaw scored CVSS 9.2.
- It can include a local PHP file and, conditionally, lead to RCE.
- Attackers used pearcmd.php to write and execute malicious PHP.
- WordPress 7.1.2 fixes releases back to version 4.7.0.
- CISA set a federal KEV remediation date of September 24, 2026.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
1 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.