EXPOSURES › CVE-2026-87902
CVE-2026-87902
HIGH ⌖ ON CISA KEV · EXPLOITEDWordPress Core's unpatched remote file inclusion flaw allowed unauthenticated attackers to execute arbitrary code via page-template resolution.
An unpatched remote file inclusion vulnerability in WordPress Core enabled unauthenticated attackers to include arbitrary local .php files outside theme directories, resulting in remote code execution. DIB organizations must ensure CMS platforms are patched promptly, as unpatched flaws in widely deployed software like WordPress are frequently exploited in the wild and can lead to severe data breaches or ransomware incidents.
Shame score — WordPress Core shipped with a known, unpatched remote file inclusion vulnerability that was actively exploited in the wild, demonstrating severe negligence in patch management for a foundational CMS platform.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.