CISA Adds WordPress Core Flaw CVE-2026-87902 to KEV Catalog

CISA added CVE-2026-87902, a remote file inclusion vulnerability in WordPress Core, to its Known Exploited Vulnerabilities catalog on September 25 and gave federal agencies until September 28 to act on it.

The bug sits in how WordPress resolves page templates. According to the WordPress security advisory, an unauthenticated attacker can get get_page_template() to load a readable local .php file from outside the active theme's folders. When specific server and theme conditions line up, that can end in remote code execution.

Exposure depends on the active theme and the server setup. WordPress says the active parent or child theme must have a top-level folder whose name begins with "page-", which covers the older Twenty Twelve and Twenty Fourteen themes plus third-party themes such as Neve, Hestia and Sydney. The attacker also needs a usable .php file on the server; the advisory points to PEAR's pearcmd.php when register_argc_argv is enabled, which applies to the official PHP Docker image and to default cPanel setups on PHP versions older than 8.5.

WordPress 7.1.2 carries the fix, with backports to 4.7. WordPress also shipped the patch to older branches, including 7.0.6, 6.9.9 and 6.8.10, and to every branch back to 4.7.

NVD and WordPress score the flaw differently. The NVD record, published September 22, lists a CVSS 3.1 score of 8.1 (High) from CISA's ADP team, with high attack complexity and no privileges or user interaction required. The WordPress advisory rates it critical at 9.2 under CVSS 4.0.

CISA's entry sets a three-day window for federal agencies. Agencies must apply vendor mitigations under BOD 26-04, including its forensic triage requirements, or stop using the product if mitigations are unavailable. CISA lists ransomware use as unknown.