CISA adds WordPress Core remote file inclusion flaw CVE-2026-87902 to KEV catalog on evidence of active exploitation
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-25 based on evidence of active exploitation: CVE-2026-87902, a remote file inclusion flaw in WordPress Core. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical details, affected versions, exploitation specifics or attribution.
The alert also references BOD 26-04, which requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. It further sets expectations for checking whether threat actors compromised a system before the patch was applied. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-87902. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
WordPress 7.0.2 - Path Travesal
An unauthenticated visitor can abuse missing path containment in WordPress page-template resolution, using crafted POST requests that name a published page, to make the site include local PHP files outside the theme. The script chains this with PEAR, writing a file containing PHP and then including it, giving code execution as the web server user. It needs a theme directory starting with page-, readable PEAR, register_argc_argv enabled and a writable directory. It is a working, lab-tested exploit; fixed in 7.1.2 and 7.0.6.
Detalhes técnicos
- CVE-2026-87902: WordPress Core, remote file inclusion vulnerability.
- The article does not name affected versions, exploitation methods, IOCs or threat actors.
Remediação
- Prioritize remediation of CVE-2026-87902 on WordPress installations, especially those that are publicly exposed.
- Consult the WordPress vendor advisory for affected versions and patches; the CISA alert does not list them.
- Per BOD 26-04, check whether systems were compromised before the patch was applied.
Linha do tempo
-
CISA adds WordPress Core remote file inclusion flaw CVE-2026-87902 to KEV catalog on evidence of active exploitation
ler a análise desta fonte ocultar
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-25 based on evidence of active exploitation: CVE-2026-87902, a remote file inclusion flaw in WordPress Core. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical details, affected versions, exploitation specifics or attribution.
The alert also references BOD 26-04, which requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. It further sets expectations for checking whether threat actors compromised a system before the patch was applied. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Technical Details
- CVE-2026-87902: WordPress Core, remote file inclusion vulnerability.
- The article does not name affected versions, exploitation methods, IOCs or threat actors.
Remediation
- Prioritize remediation of CVE-2026-87902 on WordPress installations, especially those that are publicly exposed.
- Consult the WordPress vendor advisory for affected versions and patches; the CISA alert does not list them.
- Per BOD 26-04, check whether systems were compromised before the patch was applied.