Local File Inclusion in WordPress Leading to Remote Code Execution
CVE-2026-87902
Key Information:
Badges
What is CVE-2026-87902?
CVE-2026-87902 is a notable vulnerability in WordPress, a widely-used content management system that powers a significant portion of the internet. This vulnerability specifically involves Local File Inclusion (LFI), allowing an unauthenticated attacker to manipulate the get_page_template() function to include arbitrary local .php files. This can occur when certain server conditions and the active theme's settings align. If successfully exploited, this flaw could lead to Remote Code Execution (RCE), giving the attacker full control over the targeted WordPress site. The potential for RCE is particularly alarming, as it can result in unauthorized access to sensitive data, the alteration of site content, or even leveraging the site to launch further attacks against other systems.
Potential impact of CVE-2026-87902
-
Remote Code Execution: The primary risk stemming from this vulnerability is the ability for attackers to execute arbitrary code on the server. This may allow malicious actors to install malware, create backdoors, or manipulate server configurations, leading to broader compromises of organizational resources.
-
Data Breaches: Due to the access granted by RCE, attackers could potentially exfiltrate sensitive information, including user data, credentials, and private files, leading to significant data privacy violations and compliance issues.
-
Site Manipulation: The exploitation of this vulnerability can also lead to unauthorized modifications of the website's content. This can harm the organization's reputation, mislead customers, and cause loss of trust, as attackers might alter web pages to distribute misinformation or host phishing scams.
CISA has reported CVE-2026-87902
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-87902 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Version(s)
WordPress 0 < 7.1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Spiceworks IncCVE-2026-87902The patch is out — and attackers are already racing to exploit it - Spiceworks
Public patch disclosures give attackers a head start. Modern patching requires risk-based deployment speed over rigid calendars
6 days ago
SwapupdateCVE-2026-87902Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure - SwapUpdate
Ravie LakshmananSep 24, 2026Vulnerability / Web Security
3 weeks ago
WebpronewsCVE-2026-87902Critical Contact Form 7 Vulnerability CVE-2026-87902 Actively Exploited in WordPress 6.6
WordPress sites face active exploitation of critical CVE-2026-87902 in Contact Form 7 (v5.9.2–5.9.5) on WordPress 6.6.x, enabling unauthenticated attackers to upload PHP backdoors via directory traversal and gain full control. Immediate patching to plugin 5.9.6+ and core 6.6.2 is essential.
3 weeks ago
References
EPSS Score
39% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🦅
CISA Reported
- 📈
Vulnerability started trending
- 🟡
Public PoC available
- 👾
Exploit known to exist
- 📰
First article discovered by Help Net Security
Vulnerability published
Vulnerability Reserved