CVE-2026-87902 1

CVE-2026-87902: Word Press Core Remote File Inclusion Vulnerability

Known Exploited Vulnerabilities CISA KEV Catalog Sep 25, 2026

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

Vulnerabilities & Patching