Known Exploited Vulnerabilities September 25, 2026 · CISA KEV Catalog

CVE-2026-87902: Word Press Core Remote File Inclusion Vulnerability

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2026-87902WordPress

Related

CVE-2026-119977: Word Press Word Press Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 03, 2026

CVE-2026-63030: Word Press Core Interpretation Conflict Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026

CVE-2026-60137: Word Press Core SQL Injection Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026