Skip to content
Sign in
CVE-2026-879028.1HighCWE-98

CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability

WordPress

Fixed in Debian 13 · Affected: WordPress · Exploitation: in CISA KEV since 25 Sep

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue25 Sep
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public24 public GitHub repositories (unverified), listed by PoC-in-GitHub22 Sep
  5. Not established: not seen
95.8%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

8.1HighCVSS
LowHigh

Federal deadline

CISA KEV · added 25 Sep · catalogue entry

Passed 39 days ago

DescriptionNVD

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

What changed

Debian status tracked since 5 Nov 2026.

  1. Debian’s tracker lists Debian 12 as affected, with no fix released Debian
  2. Seen in Debian’s tracker on 5 Nov: Debian 13 fixed in wordpress 6.8.10+dfsg1-0+deb13u1 (DSA-6525-1) Debian
  3. CISA added it to the KEV catalogue CISA
  4. PoC-in-GitHub lists 24 public GitHub repositories (unverified) PoC-in-GitHub

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage10 articles · 6 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 22 Sep.

Full timeline
Quiet for 6 weekslast report 28 Sep10 articles6 outlets
22 Sep · SecurityOnline first17 Oct25 OctNow
  • Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 08:47 UTC. Security Affairs, its first report on the story. WordPress Patches Critical Flaw Enabling Conditional Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 17:38 UTC. SecurityOnline. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 07:36 UTC. SecurityWeek, its first report on the story. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 08:47 UTC. The Hacker News, its first report on the story. Attackers Exploit Critical WordPress Flaw Hours After Disclosure. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 08:26 UTC. Security Affairs. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 14:30 UTC. Security Affairs. OpenAI Agents Bypassed Controls on US and Australian Government Sites. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
All coveragerunning totalAdded to CISA KEV · 25 Sep10SecurityOnl…3Security Af…3SecurityWeek1The Hacker…1CISA1Check Point123 Sep9 Oct25 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
10 articles about CVE-2026-87902 from 6 outlets
Published (UTC)OutletHeadline
22 Sep 18:01SecurityOnlineWordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution
23 Sep 08:47Security AffairsWordPress Patches Critical Flaw Enabling Conditional Code Execution
23 Sep 17:38SecurityOnlineWordPress RCE Flaw Exploited in the Wild as PoC Goes Public
24 Sep 07:36SecurityWeekWordPress Flaw Exploited Within Hours to Gain Remote Code Execution
24 Sep 08:47The Hacker NewsAttackers Exploit Critical WordPress Flaw Hours After Disclosure
25 Sep 20:01CISACISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution
26 Sep 08:26Security AffairsCISA Warns of Actively Exploited WordPress Flaw Enabling RCE
27 Sep 14:30Security AffairsOpenAI Agents Bypassed Controls on US and Australian Government Sites
28 Sep 02:30SecurityOnlineNine Flaws Exploited as Attackers Target Edge Products and WordPress
28 Sep 14:30Check PointCheck Point Warns of Active Exploits and AI-Powered Attacks
  1. Check Point Warns of Active Exploits and AI-Powered Attacks
    Check Point · mentions it in passing
  2. Nine Flaws Exploited as Attackers Target Edge Products and WordPress
    SecurityOnline
  3. OpenAI Agents Bypassed Controls on US and Australian Government Sites
    Security Affairs
  4. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE
    Security Affairs
  5. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution
    CISA · official notice
  6. Attackers Exploit Critical WordPress Flaw Hours After Disclosure
    The Hacker News
  7. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution
    SecurityWeek
  8. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public
    SecurityOnline
Show 2 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in