CISA ADDS ACTIVELY EXPLOITED WORDPRESS CORE VULNERABILITY TO KEV CATALOG: CVE-2026-87902 ELEVATED FOR PRIORITY REMEDIATION

THREAT SUMMARY

Category: Actively Exploited Vulnerability / WordPress Core / Web Application Security / Remote File Inclusion
Affected Product(s): WordPress Core
CVE: CVE-2026-87902
Primary Risks: Active exploitation of a WordPress Core remote file inclusion vulnerability; potential compromise of affected WordPress installations depending on exploitation conditions. Specific post-exploitation outcomes were not disclosed by CISA.
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): WordPress Core installations, including publicly exposed WordPress systems where applicable.
Attack Vector: Remote file inclusion affecting WordPress Core; CISA’s September 25 alert does not provide additional exploitation mechanics or prerequisites
CISA Action: CVE-2026-87902 added to the Known Exploited Vulnerabilities Catalog on September 25, 2026
Required Response: Federal Civilian Executive Branch agencies must apply applicable BOD 26-04 risk-based remediation requirements. CISA urges all organizations to prioritize remediation of KEV vulnerabilities.

---

CISA has added CVE-2026-87902, a remote file inclusion vulnerability affecting WordPress Core, to its Known Exploited Vulnerabilities Catalog after determining that the flaw is being exploited in real-world attacks.

The September 25 addition moves CVE-2026-87902 beyond ordinary vulnerability management.

This is no longer a vulnerability being assessed solely on theoretical impact.

CISA has confirmed active exploitation. The vulnerability affects WordPress Core, placing potentially vulnerable websites and web infrastructure into a higher remediation category.

WordPress is widely used across public-facing websites, publishing systems, businesses, organizations, and government environments, making any actively exploited Core vulnerability significant from an operational perspective.

CISA states that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA’s September 25 alert confirms active exploitation of CVE-2026-87902 but does not provide additional technical details concerning affected versions, exploitation mechanics, threat attribution, or indicators of compromise.

The confirmed fact is direct: CVE-2026-87902 is being actively exploited.

---

Vulnerability Details

CVE-2026-87902 — WordPress Core Remote File Inclusion Vulnerability

CISA identifies CVE-2026-87902 as a remote file inclusion vulnerability affecting WordPress Core.

Remote file inclusion vulnerabilities involve conditions in which an application can be manipulated into including or processing a file from an unintended remote location.

The practical impact of that vulnerability class depends on the affected code path, server configuration, application privileges, security controls, and the exact exploitation conditions.

In vulnerable web environments, file inclusion weaknesses can create serious security consequences because the web application may be induced to interact with content that administrators never intended it to load or process.

CISA’s September 25 alert does not provide technical information establishing how CVE-2026-87902 is triggered.

The agency does not identify whether exploitation requires authentication, a specific WordPress configuration, a particular request pattern, a vulnerable server setting, or another prerequisite.

CISA also does not specify whether successful exploitation results in code execution, file disclosure, persistence, credential theft, website modification, or another post-exploitation outcome.

Those effects should not be attributed to CVE-2026-87902 without supporting technical evidence.

The most important established fact remains its addition to KEV based on evidence of active exploitation.

---

Affected WordPress Versions

CISA identifies the affected product as WordPress Core.

The September 25 alert does not provide a vulnerable version range, fixed version, patch level, or complete affected-product matrix.

Organizations should therefore identify all WordPress Core installations under their control and compare those deployments against applicable remediation guidance for CVE-2026-87902.

Administrators should not assume that every WordPress website is affected.

They also should not assume that an installation is safe simply because it appears operational or has received routine updates.

Accurate asset inventory is critical.

Organizations should identify:

• Production WordPress websites.
• Development and staging environments.
• Archived or legacy WordPress installations.
• Microsites and secondary domains.
• WordPress instances operated by departments outside central IT.
• Hosted environments administered by third-party providers.
• Public-facing test installations.
• Abandoned sites that remain reachable from the internet.

Older or forgotten WordPress instances can remain exposed long after they stop receiving regular administrative attention.

Those systems should be included in vulnerability assessments rather than excluded because they are no longer actively maintained.

---

Operational Impact

The operational risk surrounding CVE-2026-87902 is elevated because exploitation has been confirmed.

Public-facing WordPress installations are often continuously accessible from the internet.

That exposure gives malicious actors repeated opportunities to identify systems that remain vulnerable after a security issue becomes publicly known.

The exact consequences of CVE-2026-87902 depend on technical conditions that CISA has not detailed in the September 25 alert.

The current announcement does not establish that exploitation provides total control of every affected WordPress installation. It also does not confirm data theft, credential compromise, remote command execution, website defacement, malware deployment, or persistence.

Those outcomes should not be treated as confirmed characteristics of the vulnerability. The known operational risk is that attackers are already using the flaw.

That changes remediation priority.

A WordPress vulnerability placed in KEV has crossed into a different category.

Attackers are no longer waiting for defenders to assess the theoretical risk.

---

Why KEV Status Matters

CISA adds vulnerabilities to the Known Exploited Vulnerabilities Catalog only when defined conditions are met.

Potential KEV additions must have:

• A valid CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

CVE-2026-87902 now meets that threshold.

KEV inclusion is important because it separates known exploitation from vulnerabilities that have not yet been observed in active attacks.

That distinction changes how defenders should prioritize their workload.

Organizations frequently manage thousands of vulnerabilities across servers, applications, cloud platforms, endpoints, network appliances, and public-facing services.

Treating every CVE as equally urgent can overwhelm security teams. KEV provides a narrower operational signal. The vulnerability is not simply severe on paper. It is being used.

For WordPress administrators, that means exposure time becomes a critical factor.

Every vulnerable installation that remains reachable gives attackers another opportunity to exploit the flaw before remediation is completed.

---

Federal Response

CISA’s September 25 action places CVE-2026-87902 under the federal vulnerability-management framework established by Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

The directive requires agencies to prioritize rapid remediation of high-risk KEV vulnerabilities, particularly those affecting publicly exposed assets where successful exploitation grants total control of the asset.

Lower-risk vulnerabilities may receive deferred action under the directive’s risk-based approach.

BOD 26-04 also establishes expectations for determining whether a threat actor may have compromised a system before remediation was applied.

That requirement is particularly important when dealing with actively exploited vulnerabilities.

Installing a patch can remove the vulnerability.

It does not establish whether exploitation occurred before the fix.

Organizations may need to consider both remediation and compromise assessment when evaluating systems that remained vulnerable during an active exploitation period.

CISA encourages organizations outside the federal government to adopt the same risk-based vulnerability-management approach and prioritize KEV vulnerabilities.

---

Defensive Guidance

Organizations operating WordPress should identify potentially affected installations immediately and determine whether remediation is required.

Priority actions should include:

• Inventory all WordPress installations.
• Record the exact WordPress Core version for each instance.
• Identify publicly exposed WordPress websites.
• Review applicable guidance for CVE-2026-87902.
• Apply supported security updates or mitigation measures.
• Verify that updates were successfully installed.
• Confirm the running WordPress Core version after remediation.
• Identify abandoned, forgotten, or legacy WordPress installations.
• Remove internet exposure from unnecessary development or staging systems.
• Restrict administrative access where possible.
• Review administrator accounts for unauthorized additions or changes.
• Examine website files for unexpected modifications.
• Review web server logs for unusual requests.
• Check authentication logs for suspicious administrative access.
• Review plugin and theme inventories as part of the broader WordPress security assessment.
• Verify file permissions and other security controls.
• Preserve relevant logs if exploitation is suspected.
• Document remediation status across all affected sites.
• Reassess third-party hosted WordPress environments where administrative control is shared with a provider.

Organizations should also determine whether their asset inventory includes all externally accessible WordPress instances.

A vulnerability-management program cannot protect systems that administrators do not know exist.

---

Compromise Assessment

Because active exploitation is confirmed, defenders should consider whether vulnerable WordPress installations may have been targeted before remediation.

CISA’s September 25 alert does not provide specific indicators of compromise for CVE-2026-87902.

That means defenders should avoid assuming that any single artifact proves exploitation.

General areas worth reviewing can include:

• Unexpected changes to WordPress Core files.
• New or unknown administrator accounts.
• Unexplained password changes.
• Suspicious authentication activity.
• Unusual requests in web server logs.
• Unexpected files appearing in web-accessible directories.
• Changes to configuration files.
• Unexplained redirects.
• Unexpected scheduled tasks or application behavior.
• Unauthorized modifications to site content.
• Changes occurring outside normal maintenance windows.
• Connections from unfamiliar IP addresses to administrative interfaces.
• New plugins or themes that administrators did not install.
• Security alerts generated during the period the site remained vulnerable.

Those indicators are not confirmed signatures of CVE-2026-87902.

They are general compromise-review areas that may help defenders identify suspicious activity while more vulnerability-specific guidance becomes available.

If evidence suggests a site may have been compromised, applying an update alone should not automatically close the investigation.

Organizations may need to preserve evidence, verify file integrity, review administrative accounts, rotate credentials, and determine whether other systems connected to the affected site require examination.

---

30-Day Outlook

TRJ assesses that the immediate operational risk surrounding CVE-2026-87902 will remain elevated following its addition to the KEV Catalog.

Organizations should expect:

• Increased scanning for vulnerable WordPress installations.
• Greater attention from attackers toward unpatched public-facing sites.
• Continued defensive review of WordPress Core versions.
• More organizations identifying forgotten or unmanaged WordPress instances.
• Increased monitoring of administrative access and web server activity.
• Additional remediation activity across hosted WordPress environments.
• Greater scrutiny of legacy WordPress installations.
• Continued assessment of whether vulnerable systems were compromised before remediation.
• Further technical guidance if CISA, WordPress, or other official sources publish additional information.

Public KEV inclusion also increases awareness of the vulnerability across both the defensive and offensive security communities.

That makes remediation speed important.

Attackers do not need every WordPress site to be vulnerable.

They need only enough unpatched systems to remain online long enough to identify and exploit them.

Organizations that operate numerous WordPress instances should therefore treat inventory accuracy and patch verification as part of the same response.

---

TRJ Verdict

CVE-2026-87902 is no longer simply another WordPress vulnerability waiting to be evaluated. CISA has confirmed active exploitation and added the WordPress Core remote file inclusion flaw to the Known Exploited Vulnerabilities Catalog.

The September 25 alert does not provide affected-version ranges, technical exploit mechanics, attacker attribution, or specific indicators of compromise. Those gaps matter, and defenders should not fill them with assumptions.

What CISA has confirmed is enough to change the operational priority.

Organizations running WordPress should identify every Core installation they operate, determine which systems are affected, apply supported remediation, verify that the fix is actually in place, and review vulnerable systems for signs of suspicious activity where exposure existed before remediation.

WordPress environments are often public-facing, widely distributed, and easy to overlook when older sites remain online outside normal administrative workflows. That makes asset inventory just as important as patching.

For CVE-2026-87902, the response should be direct: find the affected WordPress installations, remediate them, verify the result, and determine whether attackers reached them before the vulnerability was closed.

---

Note: WordPress released 7.1.2 on September 22, 2026 for CVE-2026-87902. The vendor describes the flaw as unauthenticated local PHP file inclusion through page-template resolution, with remote code execution possible only when specific server and active-theme preconditions are met. The security fix was backported to eligible supported branches through WordPress 4.7. CISA’s KEV label remains remote file inclusion.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---