CISA added WordPress CVE-2026-87902 to its exploited-vulnerability list, giving defenders a September 28 federal remediation deadline.
Answer first: CISA added WordPress Core CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on September 25, confirming that the agency has evidence of real-world exploitation. The flaw can let an unauthenticated request steer page-template resolution toward a readable PHP file outside the active theme directories. Under the right server and file conditions, that inclusion can become remote code execution.
The practical action is straightforward: update to WordPress 7.1.2 or the fixed release for the site’s supported branch, then hunt for suspicious activity that may have happened before patching. CISA’s September 28 deadline applies directly to covered US federal civilian agencies, but the KEV listing is a useful priority signal for every organization.
What the WordPress RFI flaw changes
The vulnerability sits in page-template resolution, a core function that selects a PHP file when WordPress renders a page. The security boundary should keep that selection inside approved theme locations. The disclosed path-traversal condition could point the resolver outside those directories to another readable PHP file.
File inclusion does not produce the identical outcome on every installation. Remote code execution depends on what local PHP files exist, whether an attacker can influence one of them, and how the server is configured. That is why “conditional RCE” is more accurate than saying every unpatched site can be taken over with one universal request. The KEV addition nevertheless establishes that the weakness is not merely theoretical.
Patch first, then investigate
WordPress published 7.1.2 and security backports for maintained older branches. Site owners should use the platform’s normal update mechanism, verify the installed version afterward and confirm that caching or deployment images did not restore vulnerable code. Managed hosts should document when the patched build reached each tenant, not only when the control panel announced it.
After patching, review web requests aimed at template resolution, unexpected PHP files in writable locations, changes to administrator accounts, new scheduled tasks and unexplained outbound connections. Exact indicators should come from trusted incident-response guidance because public exploit traffic evolves quickly. A clean current version prevents the known path going forward; it does not prove an earlier vulnerable site was untouched.
Operators running many sites should prioritize internet-facing instances, sites with custom themes, and hosts that permit PHP files in writable locations. The earlier Elementor CSRF patch showed the same inventory problem: knowing a fix exists is different from knowing every production instance received it.
What the KEV label does and does not mean
CISA’s catalog means the agency has sufficient evidence that attackers have exploited the vulnerability. It does not publish a victim count, identify every campaign or prove that ransomware is involved. The catalog’s “known ransomware campaign use” field should be read separately from the exploited status.
The three-day federal deadline is unusually short and signals remediation urgency. Private organizations are not automatically bound by that directive, but teams can reasonably move the flaw ahead of higher-scoring vulnerabilities that lack exploitation evidence. Exposure, asset value and compensating controls still matter.
The verified story is therefore narrower than some alerts suggest: a core WordPress path-boundary failure has a vendor fix, several institutions have corroborated the risk, and CISA now says exploitation is occurring. That is enough to justify immediate patching without claiming that every scan succeeds or every WordPress site is compromised.
Frequently asked questions
Which WordPress versions are fixed?
WordPress 7.1.2 fixes the issue, and the project issued security backports for maintained older branches. Confirm the fixed point for the branch actually deployed.
Does CVE-2026-87902 always lead to code execution?
No. Code execution depends on the available local PHP file and server conditions, but unauthorized file inclusion is itself a serious boundary failure.
Who must meet the September 28 deadline?
The binding KEV deadline applies to covered US federal civilian agencies. Other organizations can use it as a strong risk-prioritization signal.
Verified facts
| KEV addition | September 25, 2026 |
|---|---|
| Vulnerability | CVE-2026-87902 |
| Affected component | WordPress Core page-template resolution |
| Risk | Unauthenticated file inclusion; conditional remote code execution |
| Federal due date | September 28, 2026 |
Sources
- CISA Known Exploited Vulnerabilities Catalog — Official KEV addition and federal due date.
- WordPress 7.1.2 release — Vendor security release and supported patched branches.
- Canadian Centre for Cyber Security — Independent government advisory noting exploitation reporting.
- CUHK IT Security Centre — Independent institutional advisory and remediation guidance.
- Red Hat CVE record — Independent CVE assessment and component context.
Disclosure note: This report distinguishes confirmed exploitation or internal observations from inference. Syndicated accounts were not counted as separate verification.
Related Lapaas Voice coverage: Roundcube active-exploitation advisory.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
