CVE-2026-87902

Community ground truth

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

• ▲0▼
  Field note · TruePositive EditorialCurated

  WordPress Core Remote File Inclusion Vulnerability — WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution. Listed in the CISA KEV catalog (added 2026-09-25) — confirmed exploited in the wild, not theoretical. FIRST EPSS puts the chance of exploitation in the next 30 days at ~3%. Treat it as real and prioritize remediation over triage.

• ▲0▼
  Remediation · TruePositive EditorialCurated

  Required action for WordPress Core: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA set a federal remediation due date of 2026-09-28. After patching, verify the vulnerable path is no longer reachable before closing the finding.