HIGHVulnerability
Verified
Global

CISA KEV: WordPress Core — WordPress Core Remote File Inclusion Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

Analysis

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-25. Remediation due: 2026-09-28.

Indicators of Compromise (1)

CVE (1)
CVE-2026-87902
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 25, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerabilityNEW

Monarch acquires HMBradley

Personal finance platform Monarch has acquired MBI, the digital banking fintech formerly known as HMBradley.

Finextra
MEDIUMVulnerability

Iranian accused of hacking American universities extradited from Montenegro

An Iranian national accused by the U.S. of taking part in dozens of breaches involving the theft of academic data and intellectual property has been extradited from Montenegro.

The Record
MEDIUMVulnerability

Sibos 2026: What does a successful ESG strategy look like?

How can global financial institutions maintain a coherent sustainability strategy with constantly shifting expectations? This was discussed at Sibos Miami 2026 by a panel of experts.

Finextra