CVE-2026-87902

Vendor

WordPress

Product

Core

CVSS

8.1

CISA KEV

added 25 Sep 2026, due 28 Sep 2026 (34d overdue)

Weakness

CWE-98

Exposure class

Web platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 72
   KEV NVD 22 Sep 2026

   WordPress Core Remote File Inclusion Vulnerability

   WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories…

   KEV · due 28 Sep 2026 (overdue) CVSS 8.1 Fix available CVE-2026-87902 WordPress
2. 52
   CISA alert CISA 25 Sep 2026

   CISA Adds One Known Exploited Vulnerability to Catalog

   CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability This type of vulnerability is…

   Exploited CVE-2026-87902
3. 16
   Research Check Point Research 28 Sep 2026

   28th September – Threat Intelligence Report

   For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the…

   CVE-2026-85102CVE-2026-93616CVE-2026-94127+1 more