CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability
Published Sep 22, 2026 · updated Sep 28, 2026 · WordPress Core
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local file outside the active theme directories, leading to remote code execution.
Timeline
Detection, updates, and resolution for this record.
Sep 22, 2026 · Catalog
Detected
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local file outside the active theme directories, leading to remote code execution.
Sep 25, 2026 · CISA KEV
Known exploited
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Sep 28, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Sep 28, 2026 · Catalog
Updated
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local file outside the active theme directories, leading to remote code execution.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date Sep 28, 2026
Affected
- cpe wordpress/wordpressversion unspecified
- vendor WordPress Coreversion unspecified
Sources
- CISA KEVCVE-2026-87902
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local file outside the active theme directories, leading to remote code execution.
cisa.gov - CVE.orgCVE-2026-87902
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-87902
30-day exploitation probability 40.0%
first.org - Exploit Database52690
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2026-87902
An unauthenticated attacker can make page-template resolution include a chosen readable local file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
nvd.nist.gov