U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited WordPress Core flaw CVE-2026-87902 to the Known Exploited Vulnerabilities catalog.
Stories per day · 30 days
2 RSS
15 stories, newest first · one card per story
Stories tagged #cve-2026-87902
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added actively exploited WordPress Core remote file inclusion CVE-2026-87902 to the KEV catalog.
Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code
Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.
8
WordPress patches a critical severity security vulnerability
WordPress patched critical unauthenticated RCE CVE-2026-87902 in 7.1.2; attackers weaponized pearcmd.php within hours of disclosure.
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Attackers began exploiting critical WordPress path-traversal CVE-2026-87902 for remote code execution within hours of disclosure.
1
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
3
Hackers start exploiting critical WordPress flaw for code execution
Attackers are exploiting critical WordPress flaw CVE-2026-87902 for unauthenticated code execution.
3
WordPress security advisory (AV26-952)
WordPress before 7.1.2 is under active attack via CVE-2026-87902, an unauthenticated path traversal that can yield remote code execution.
2
CVE-2026-87902 in WordPress Enables Conditional RCE
WordPress patches CVE-2026-87902, an unauthenticated path traversal that can enable conditional remote code execution.
Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code
WordPress 7.1.2 patches a critical CVSS 9.2 path traversal flaw (CVE-2026-87902) that could allow unauthenticated RCE under specific theme and server configurations.
4
Critical WordPress Core Vulnerability Lets Attackers Execute Code Without Logging In
WordPress 7.1.2 patches a critical unauthenticated remote code execution flaw (CVE-2026-87902) in the core template resolution mechanism.
1
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Attackers probed unauthenticated WordPress LFI CVE-2026-87902 within hours of the 7.1.2 patch.
5
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress patched critical CVE-2026-87902 (CVSS 9.2), an unauthenticated flaw that can execute code on some servers.
4
WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
WordPress 7.1.2 fixes unauthenticated LFI CVE-2026-87902 that can reach remote code execution.
3
WordPress 7.1.2 Release
WordPress 7.1.2 patches critical unauthenticated local file inclusion that can lead to remote code execution.