THE US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability, CVE-2026-87902, to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw has a CVSS score of 9.2 and affects WordPress versions dating back to 4.7.0. It does not require authentication, meaning an unauthenticated attacker can trigger it.
The vulnerability involves the `get_page_template()` function, which can be made to include a readable local PHP file outside the active theme directories. Under specific server and theme conditions, this can result in remote code execution. The article says the flaw is being actively exploited, with attackers using `pearcmd.php` to write malicious PHP files and execute code. WordPress released version 7.1.2 to address the issue. Robert Ressl is credited with reporting it.
Under Binding Operational Directive 22-01, US federal civilian executive-branch agencies must remediate vulnerabilities listed in the KEV catalogue by CISA’s deadline. The article states that agencies were required to fix this vulnerability by 24 September 2026, and recommends that private organisations review the catalogue and address affected systems in their own environments.