CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based…
Why it matters
CISA lists this as exploited in the wild. Unpatched WordPress and Core systems are exposed to active attacks now.
Patch
Apply the vendor's security update for WordPress and Core.
CISA added CVE-2026-87902 (WordPress Core) to its Known Exploited Vulnerabilities catalog on September 25, 2026, which means there is reliable evidence of exploitation in the wild. WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to…
Why it matters
CISA lists this as exploited in the wild. Unpatched WordPress and Core systems are exposed to active attacks now.
Patch
Apply the vendor's security update for WordPress and Core.
