CVE-2026-87902

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 10/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

CISA Known Exploited Vulnerability

Vendor / Product WordPress — Core

Date Added 2026-09-25

Remediation Due 2026-09-28

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902

Weakness Classification (1)

CWE-98

Affected Software (25)

Vendor	Product	Version
wordpress	wordpress	< 4.7.37
wordpress	wordpress	4.8 – 4.8.32
wordpress	wordpress	4.9 – 4.9.33
wordpress	wordpress	5.0 – 5.0.29
wordpress	wordpress	5.1 – 5.1.26
wordpress	wordpress	5.2 – 5.2.28
wordpress	wordpress	5.3 – 5.3.25
wordpress	wordpress	5.4 – 5.4.23
wordpress	wordpress	5.5 – 5.5.22
wordpress	wordpress	5.6 – 5.6.21
wordpress	wordpress	5.7 – 5.7.19
wordpress	wordpress	5.8 – 5.8.17
wordpress	wordpress	5.9 – 5.9.18
wordpress	wordpress	6.0 – 6.0.16
wordpress	wordpress	6.1 – 6.1.14
wordpress	wordpress	6.2 – 6.2.13
wordpress	wordpress	6.3 – 6.3.12
wordpress	wordpress	6.4 – 6.4.12
wordpress	wordpress	6.5 – 6.5.12
wordpress	wordpress	6.6 – 6.6.9
wordpress	wordpress	6.7 – 6.7.9
wordpress	wordpress	6.8 – 6.8.10
wordpress	wordpress	6.9 – 6.9.9
wordpress	wordpress	7.0 – 7.0.6
wordpress	wordpress	7.1 – 7.1.2