CVE-2026-87902Active Exploitation(wordpress / wordpress)

CRITICALCVSS 8.1 · HIGHCISA KEV

Exploitation observed; activity peaked at 106 mentions and remains active

Immediate actions

Patch wordpress wordpress systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

wordpress CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-28. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902

Weakness type (CWE)

CWE-98

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wordpress

Threat summary

Active exploitation appears in 198 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
435 mentions across 30 observed days

What's happening

Active exploitation reported across 198 signals
Exploit tool or code specified in 30 signals
PoC mentioned or linked in 60 signals
Patch or workaround mentioned in 250 signals
Technical details provided in 281 signals
Disclosure: 48 classified signals
Peaked 27d ago at 106 mentions (2026-09-24); latest day: 1
435 total mentions across 30 days

Affected systems

Vendors

wordpress

Products

wordpress

Deep dive

Activity timeline435 mentions / 30d

Signal classification7 categories

Active Exploitation

19745.8%

Patch

11927.7%

Disclosure

4811.2%

PoC

317.2%

General

204.7%

Exploit

133.0%

Referenced assets207 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	37	Active Exploitation2Disclosure1Exploit9General3Patch15PoC7
2026-09-23	82	Active Exploitation20Disclosure9Exploit3General2Patch37PoC11
2026-09-24	106	Active Exploitation60Disclosure15False Positive1General6Patch18PoC6
2026-09-25	54	Active Exploitation30Disclosure4General2Patch16PoC2
2026-09-26	36	Active Exploitation23Disclosure4False Positive1General3Patch5
2026-09-27	11	Active Exploitation6Disclosure3General1Patch1
2026-09-28	26	Active Exploitation17Disclosure4General1Patch3PoC1
2026-09-29	11	Active Exploitation7Disclosure1General1Patch1PoC1
2026-09-30	12	Active Exploitation5Disclosure1Patch6
2026-10-01	11	Active Exploitation4Disclosure1Exploit1Patch5
2026-10-02	5	Active Exploitation2Patch2PoC1
2026-10-03	4	Active Exploitation1Disclosure1Patch2
2026-10-04	1	Patch1
2026-10-05	4	Active Exploitation4
2026-10-06	5	Active Exploitation3Patch2
2026-10-07	1	Disclosure1
2026-10-08	2	Active Exploitation1Patch1
2026-10-09	3	Disclosure2Patch1
2026-10-12	3	Active Exploitation1Patch1PoC1
2026-10-13	1	PoC1
2026-10-15	2	Active Exploitation2
2026-10-19	1	Patch1
2026-10-20	1	Active Exploitation1
2026-10-22	2	Active Exploitation1General1
2026-10-26	1	Patch1
2026-10-28	4	Active Exploitation4
2026-10-29	3	Active Exploitation2Disclosure1
2026-11-04	1	Active Exploitation1

Full discourse20 posts

エックスサーバー【公式】@xserverjp44d
Patch
【重要】WordPressをご利用の方へ WordPressのコア機能に、重大な脆弱性「CVE-2026-87902」が確認されています。至急、9/22以降に公開された各系列の最新版へアップデートしてください。 ■影響を受けるバージョン WordPress 4.7.x系～ 7.1.x系 ※9/17公開の7.1.1も対象です自動更新を有効にしている場合も、更新が完了しているかご確認ください。 ▼ニュースページはこちら https://www.xserver.ne.jp/news_detail.php?view_id=19514
Post summary
Japanese advisory warning of a critical WordPress core vulnerability (CVE-2026-87902) affecting versions 4.7.x through 7.1.x, urging immediate update to patched versions released after 9/22.
133184743451184.4K
48.7K followersView on X
The Hacker News@TheHackersNews46d
Patch
‼️ URGENT - WordPress issues patch a new critical flaw (CVE-2026-87902) that requires no account and can lead to code execution on some servers. Versions 4.7.0 through 7.1.1 are affected. Here's how the flaw works: https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
Post summary
A news-style post announcing a critical WordPress RCE patch (CVE-2026-87902) affecting versions 4.7.0–7.1.1 with no auth required; primary focus is on the availability of a patch, with a link to further details.
12971530915062.6K
2.4M followersView on X
Dhiyaneshwaran@DhiyaneshDK45d
Patch
🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml Reference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp #hackwithautomation #bugbounty #wordpress https://t.co/GAC3YpllZ5
Post summary
The tweet discloses CVE-2026-87902 in WordPress Core, shares a Nuclei detection template, and references the official WordPress security advisory indicating a patch is available.
147222714611.3K
4.9K followersView on X
Ryx@PadhiyarRushi45d
PoC
Unauth WordPress LFI → PHP exec. Public PoC is live!!! CVE-2026-87902. get_page_template() builds page-{urldecode($pagename)}.php. locate_template() includes it with no theme-root jail. No account. Pair a page-templates/ theme with pearcmd.php (register_argc_argv=On) and you get two-request www-data RCE. Lab-verified Sept 22. Fixed in 7.1.2 / backports to 4.7.37. https://github.com/ressl/cve-2026-87902-poc #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WordPress #RCE #BugBounty
Post summary
The tweet announces a public PoC for CVE-2026-87902, describes the LFI-to-RCE vulnerability details, and notes available fixed versions.
23501601078.4K
954 followersView on X
The Hacker News@TheHackersNews44d
Active Exploitation
⚡ Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure. The attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met. 🔗 How the exploit works → https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html
Post summary
The text reports that attackers are actively exploiting WordPress CVE-2026-87902 within hours of its disclosure using pearcmd.php under specific conditions, and includes a link to further details on how the exploit works.
66041775343.0K
2.4M followersView on X
Swissky@pentest_swissky26d
PoC
CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE https://www.pruva.dev/reproductions/REPRO-2026-00356
Post summary
The text announces CVE-2026-87902 as an unauthenticated path traversal in WordPress Core leading to conditional RCE, and includes a reproduction link (REPRO-2026-00356) as proof of concept. No exploit tool, active exploitation, or patch information is provided.
24101688810.8K
23.2K followersView on X
Brut 🇮🇳@wtf_yodhha44d
PoC
🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal ✅https://t.me/brutsecurity/3034 ✅Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml #bugbounty #wordpress https://t.co/Q5vY8ZZHtb
Post summary
The post discloses CVE-2026-87902, a PHP Template Path Traversal in WordPress Core, and links to a Nuclei template that functions as a proof of concept. No patch, active exploitation, or explicit exploit tool is confirmed in the text.
1210130535.0K
8.1K followersView on X
Ryan Dewhurst@ethicalhack3r45d
Active Exploitation
And so it begins. Started to see attempted WordPress RCE (CVE-2026-87902) exploitation in @PrevidianCyber honeypots from 104.194.9[.]227 They try to include /usr/local/lib/php/pearcmd.php They try to write a file in /tmp/ Then try to include a Github hosted upload PHP file https://t.co/wjerg34fXr
Post summary
The tweet reports observed attempts to exploit CVE-2026-87902 (WordPress RCE) via honeypots, describing specific payload paths and a GitHub-hosted PHP file, indicating active exploitation attempts.
4202110628.4K
21.2K followersView on X
Dark Web Informer@DarkWebInformer45d
PoC
🚨[POC] CVE-2026-87902: WordPress Core versions up to and including 7.1.1 are affected by a Local File Inclusion vulnerability in the locate_template() function. GitHub: https://github.com/abraxas/CVE-2026-87902 https://t.co/qfdov4vCa5
Post summary
The tweet discloses CVE-2026-87902, a Local File Inclusion vulnerability in WordPress Core's locate_template() function, and links to a GitHub proof of concept. It contains no evidence of active exploitation or a named patch.
41601175315.5K
243.6K followersView on X
Nicolas Krassas@Dinosn45d
PoC
Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab
Post summary
The tweet shares a reproduction lab, URL-list scanner, and PoC for CVE-2026-87902, an unauthenticated LFI to conditional RCE in WordPress 4.7.0-7.1.1 fixed in 7.1.2, with a link to the GitHub repository.
129196637.8K
162.6K followersView on X
エックスサーバー【公式】@xserverjp43d
Disclosure
【続報】WordPressの脆弱性（CVE-2026-87902）について現時点で判明している攻撃成立条件に該当するWordPressサイトについて、弊社側で順次アップデートを実施します。 ※アップデートを実施したお客様には、メールにて個別にご案内しますなお、弊社でのアップデート対象外でも、今後新たな攻撃方法が判明した場合には影響を受ける可能性があります。そのため、弊社での対応有無にかかわらず、9/22以降に公開された各系列の最新版へアップデートをお願いいたします。
Post summary
The advisory for CVE-2026-87902 mentions attack conditions and urges updates to latest WordPress versions after 9/22, but contains no PoC, exploit code, active exploitation claims, or specific patch details, aligning with a Disclosure classification without technical vulnerability specifics.
14051113033.4K
48.7K followersView on X
Ben Sadeghipour@NahamSec40d
Disclosure
This WordPress Core Bug Can Lead to Remote Code Execution (CVE-2026-87902)... but only under certain circumstances https://youtu.be/Ee-5PFrsGtU
Post summary
The tweet discloses a WordPress core bug (CVE-2026-87902) that can lead to remote code execution under certain conditions and includes a link to a video.
960853012.5K
253.4K followersView on X
高杉＠沼を駆けだすエンジニア@takasugi_mbsjk19d
Patch
例えば記事編集しやすいCMS、wordpressを利用していたと仮定した場合直近だけでも CVE-2026-87902 CVE-2026-93485 WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API CVE-2026-66666 といった脆弱性が発見されて修正パッチが公開されたりしているのね。そうした脆弱性への対応を医師や事務員にさせるぐらいならば、維持費25000円で外注した方が安いのですよ。維持費安すぎですねぇ。
Post summary
The text lists several WordPress CVEs with detailed technical descriptions and explicitly states that fix patches have been released, while also commenting on the cost-effectiveness of outsourcing maintenance.
9135712122.0K
2.8K followersView on X
🅰🅳🅼@securityfreax41d
Disclosure
My CSIRT week as the "incident handler on duty" so far: CVE-2026-94127 (F5 BIG-IP APM) CVE-2026-87902 (WordPress Core) CVE-2026-65660 (MS SharePoint) CITRIX Netscaler Zero Day KITEWORKS Zero Day https://t.co/AjyMG0eHa9
Post summary
The tweet lists several CVEs affecting F5 BIG-IP APM, WordPress Core, and MS SharePoint, plus zero‑day references for Citrix Netscaler and Kiteworks, without providing exploit details, patches, or evidence of active exploitation.
85159176.9K
4.3K followersView on X
Pruva@pruvadev46d
PoC
People are telling me that a new Wordpress cve is hitting the news, and what I’m doing? A repro for you! CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE https://www.pruva.dev/reproductions/REPRO-2026-00356
Post summary
The tweet announces CVE-2026-87902 and shares a link to a reproduction/POC demonstrating an unauthenticated path traversal in WordPress Core leading to conditional RCE, but does not reference active exploitation, exploit tools, or patches.
110142245.1K
91 followersView on X
HackingHub@hackinghub_io29d
Disclosure
🚨 RCE on WordPress Core: CVE-2026-87902 Here’s an overview of this critical bug: https://t.co/Qv1x3Zw74n
Post summary
The text announces a critical WordPress Core vulnerability, CVE-2026-87902, and identifies it as RCE. It provides no explicit PoC, exploit, active exploitation report, or remediation.
13049191.9K
14.4K followersView on X
CISA Cyber@CISACyber43d
Active Exploitation
🛡️We added WordPress Core remote file inclusion vulnerability CVE-2026-87902 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSe https://t.co/egngP7uUzr
Post summary
The tweet announces that CVE-2026-87902 (WordPress Core remote file inclusion) has been added to the CISA KEV Catalog, indicating active exploitation, and calls for applying mitigations. No PoC, exploit code, or specific patch details are provided in the text.
91224179.3K
303.4K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi46d
Disclosure
‼️ تحذير لمستخدمين WordPress حدث نسختك الان تم الاعلان عن ثغره خطيرة تسمح للمهاجم بتنفيذ اوامر عن بعد في الصورة الإصدارات المصابة رقم الثغرة CVE-2026-87902 https://t.co/xHfpkljmeC
Post summary
The tweet warns WordPress users about CVE-2026-87902, a remote code execution vulnerability, and shares a link, but provides no patch, exploit, or evidence of active exploitation.
37035235.0K
50.2K followersView on X
エックスサーバー【公式】@xserverjp39d
Patch
【WordPress脆弱性への緩和策を追加】 WordPressの脆弱性「CVE-2026-87902」について、当社が提供する無料のセキュリティプラグイン「CloudSecure WP Security」に緩和策を追加しました。最新版のプラグインが有効な環境では、本脆弱性を悪用した不正なファイル読み込みへの対策が、追加設定なしで適用されます。なお、本対応はWordPress本体を最新版へ更新するまでの緩和策です。アップデート可能な環境では、必ずWordPress本体を最新版へ更新してください。 ▼関連ニュース https://www.xserver.ne.jp/news_detail.php?view_id=19514&utm_source=twitter_xsrv&utm_medium=social&utm_campaign=xs_news_260930&utm_content=pr ▼インストール方法は動画をご確認ください
Post summary
The announcement adds a mitigation via the CloudSecure WP Security plugin for CVE‑2026‑87902, blocking unauthorized file read exploitation until the WordPress core is updated, and advises users to apply the core update promptly.
09131195.7K
48.7K followersView on X
ExploitGrid@exploitgrid39d
Active Exploitation
🚨 CVE-2026-87902 is now being exploited in the wild. WordPress Core flaw can enable unauthenticated local file inclusion and conditional RCE. CVSS 8.1 | KEV | Public exploit: available ExploitGrid: 95/100 Critical 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-87902
Post summary
CVE-2026-87902, a WordPress Core flaw allowing unauthenticated local file inclusion and conditional remote code execution, is being actively exploited in the wild, with a CVSS score of 8.1 and a public exploit available.
13036183.5K
403 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wordpress	wordpress	-	-	-

Explore more

Back to dashboard wordpress CVEs wordpress vulnerabilities

What researchers are saying

CVE-2026-87902

エックスサーバー【公式】[verified]@xserverjpPatch

Japanese advisory warning of a critical WordPress core vulnerability (CVE-2026-87902) affecting versions 4.7.x through 7.1.x, urging immediate update to patched versions released after 9/22.

Ryx[verified]@PadhiyarRushiPoC

The tweet announces a public PoC for CVE-2026-87902, describes the LFI-to-RCE vulnerability details, and notes available fixed versions.

Ryan Dewhurst[verified]@ethicalhack3rActive Exploitation

The tweet reports observed attempts to exploit CVE-2026-87902 (WordPress RCE) via honeypots, describing specific payload paths and a GitHub-hosted PHP file, indicating active exploitation attempts.

Nicolas Krassas[verified]@DinosnPoC

The tweet shares a reproduction lab, URL-list scanner, and PoC for CVE-2026-87902, an unauthenticated LFI to conditional RCE in WordPress 4.7.0-7.1.1 fixed in 7.1.2, with a link to the GitHub repository.

エックスサーバー【公式】[verified]@xserverjpDisclosure

The advisory for CVE-2026-87902 mentions attack conditions and urges updates to latest WordPress versions after 9/22, but contains no PoC, exploit code, active exploitation claims, or specific patch details, aligning with a Disclosure classification without technical vulnerability specifics.

Ben Sadeghipour[verified]@NahamSecDisclosure

The tweet discloses a WordPress core bug (CVE-2026-87902) that can lead to remote code execution under certain conditions and includes a link to a video.

高杉＠沼を駆けだすエンジニア[verified]@takasugi_mbsjkPatch

The text lists several WordPress CVEs with detailed technical descriptions and explicitly states that fix patches have been released, while also commenting on the cost-effectiveness of outsourcing maintenance.

🅰🅳🅼[verified]@securityfreaxDisclosure

The tweet lists several CVEs affecting F5 BIG-IP APM, WordPress Core, and MS SharePoint, plus zero‑day references for Citrix Netscaler and Kiteworks, without providing exploit details, patches, or evidence of active exploitation.