Is CVE-2026-87902 in the CISA Known Exploited Vulnerabilities catalog?

Yes — CVE-2026-87902 is listed in CISA KEV, remediation due 2026-09-28.

Which frameworks does CVE-2026-87902 affect?

CVE-2026-87902 affects WordPress.

CISA Known Exploited Vulnerability

CVE-2026-87902: WordPress vulnerability (actively exploited)

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the act

⚠ Actively exploited (CISA KEV) WordPress 2026

CISA catalog entry

Product

Core

Vendor

WordPress

Added to KEV

2026-09-25

Remediation due

2026-09-28

What WebPulse reported · 1 analysis

WordPress Patches Unauthenticated RCE Path Spanning Decade of Releases

CVE-2026-87902 scores 9.2 CVSS and affects every WordPress Core branch from 4.7.0 through 7.1.1, patched September 22.

September 27, 2026

View CVE-2026-87902 on the NIST National Vulnerability Database →

Related vulnerabilities

CVE-2026-60137 CVE-2026-8206 CVE-2026-8181 CVE-2026-63030 CVE-2026-10795 CVE-2026-3844 CVE-2026-1293 CVE-2026-8732