WordPress Core CVE-2026-87902 in CISA KEV: File Inclusion via Page Templates

On September 25, 2026, CISA added CVE-2026-87902 to its KEV catalog, with a deadline of September 28. It affects WordPress core — not a plugin, not a theme — and lets an unauthenticated attacker reach code execution.

NVD hasn't published a score, vector or version list at the time of writing. Everything below relies on the CISA entry alone. For the version to install, the WordPress.org security announcement is authoritative.

What CISA Says

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution.

Three things to take away:

• Unauthenticated. No account on the site needed.
• Page-template resolution. That's the mechanism that decides which theme PHP file renders a given page. It runs on every install: every page served goes through it.
• A readable local .php file outside the active theme. The attacker doesn't inject code remotely: they get WordPress to include a file that already exists on the server, but that should never have been loaded in that context.

Why It's Serious Despite the "Local File" Constraint

You might think having to target an existing file limits the impact a lot. In practice, a WordPress install holds hundreds of PHP files outside the active theme: inactive themes, plugins that were deactivated but never deleted, install scripts, maintenance tools left behind by a contractor. Each one becomes executable outside its intended context, without the checks that normally surround it.

And if an attacker can drop a file on the server by other means, even in a directory where it isn't supposed to run, this kind of flaw is exactly what gets it executed. That's why CISA calls it RCE.

Exploitation is confirmed by the KEV listing. On a CMS deployed at this scale, with no authentication required, assume automated scanning is already underway.

Versions

NVD has published no affected or fixed versions. I won't invent any. Check the WordPress.org security announcement for CVE-2026-87902, and verify the version actually installed on each site (dashboard, or wp core version with WP-CLI).

Watch out: minor security updates are applied automatically by default. Plenty of hosts and agencies turn them off, though. If that's you, those sites have received nothing.

Detection

• Core integrity: wp core verify-checksums flags any modified or added core file
• Unexpected PHP files in wp-content/uploads/ and in theme and plugin directories, especially recent ones
• Access logs: spikes of unusual requests to public pages, atypical query parameters, PHP "include" errors in error logs
• Administrator accounts created recently, and site option changes nobody made
• Child processes of PHP-FPM or the web server

Mitigation

1. Update WordPress to the security release named by WordPress.org, on every site. The CISA deadline is today.
2. Re-enable automatic core security updates wherever they were switched off.
3. Delete inactive themes and plugins, install scripts and forgotten tools: every PHP file removed is one that can't be included.
4. Block PHP execution in wp-content/uploads/ at the web server level.
5. If you run a WAF, check whether the vendor has shipped a rule for this CVE — on top of the update, not instead of it.
6. If compromised: restore from a clean backup, rotate the secrets in wp-config.php (database, salts) and administrator passwords.

This isn't the first time this year WordPress core has landed in KEV: in July, two chained CVEs already led to unauthenticated RCE.

Why Continuous Monitoring of Your WordPress Sites Matters

A WordPress estate is often dozens of sites, hosted in different places, updated by different people. When a core flaw is exploited with a three-day deadline and no version published by NVD, knowing which site runs which version is the only thing that lets you move fast.

With cveo.tech, inventory your sites and their versions, and get alerted as soon as a CISA KEV CVE affects them.