CISA Adds WordPress Core Remote File Inclusion to KEV
Tech GuruQuick Answer
CISA lists CVE-2026-87902 as exploited. Under the WordPress advisory's theme and PHP/server conditions, page-template resolution can include a readable local PHP file outside the active theme directories and lead to code execution. Update the affected core branch and review the installation for compromise; the precise prerequisites matter.
Confirm Scope And Apply The Supported Fix
Next step: Match the site's core version to the branch table and current WordPress advisory. CISA's entry also requires forensic triage. Preserve suspicious files and logs, back up the site and database, and apply the supported update without delaying containment of a suspected compromise.
Last verified: 2026-09-26 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | WordPress Core with the advisory's theme and PHP/server preconditions |
|---|---|
| Advisory | CISA KEV: CVE-2026-87902 / GHSA-7hp8-65ch-5whp |
| CVE | CVE-2026-87902 |
| Authoritative release date | WordPress advisory 2026-09-22 13:57:27 UTC; CISA KEV addition 2026-09-25 |
| Authority revision date | 2026-09-22 14:24:56 UTC |
| Affected versions | WordPress 7.1.0 - 7.1.1; WordPress 7.0.0 - 7.0.5; WordPress 6.9.0 - 6.9.8; WordPress 6.8.0 - 6.8.9; WordPress 6.7.0 - 6.7.8; WordPress 6.6.0 - 6.6.8; WordPress 6.5.0 - 6.5.11; WordPress 6.4.0 - 6.4.11; WordPress 6.3.0 - 6.3.11; WordPress 6.2.0 - 6.2.12; WordPress 6.1.0 - 6.1.13; WordPress 6.0.0 - 6.0.15; WordPress 5.9.0 - 5.9.17; WordPress 5.8.0 - 5.8.16; WordPress 5.7.0 - 5.7.18; WordPress 5.6.0 - 5.6.20; WordPress 5.5.0 - 5.5.21; WordPress 5.4.0 - 5.4.22; WordPress 5.3.0 - 5.3.24; WordPress 5.2.0 - 5.2.27; WordPress 5.1.0 - 5.1.25; WordPress 5.0.0 - 5.0.28; WordPress 4.9.0 - 4.9.32; WordPress 4.8.0 - 4.8.31; WordPress 4.7.0 - 4.7.36 |
| Fixed version | WordPress 7.1.2; WordPress 7.0.6; WordPress 6.9.9; WordPress 6.8.10; WordPress 6.7.9; WordPress 6.6.9; WordPress 6.5.12; WordPress 6.4.12; WordPress 6.3.12; WordPress 6.2.13; WordPress 6.1.14; WordPress 6.0.16; WordPress 5.9.18; WordPress 5.8.17; WordPress 5.7.19; WordPress 5.6.21; WordPress 5.5.22; WordPress 5.4.23; WordPress 5.3.25; WordPress 5.2.28; WordPress 5.1.26; WordPress 5.0.29; WordPress 4.9.33; WordPress 4.8.32; WordPress 4.7.37 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Critical |
| Exploitation status | CISA added this CVE to KEV on 2026-09-25. Exploitation is known in the wild; ransomware use was recorded as Unknown. Investigate site-specific compromise separately. |
What Changed
The project describes a local-file inclusion path reached through unauthenticated template resolution. That is more specific than a claim that any remote file can be included on every installation. KEV establishes observed exploitation of the vulnerability, not proof that your particular site was attacked.
What To Validate Now
- Inventory. Locate WordPress Core with the advisory's theme and PHP/server preconditions deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the installed core branch to the affected-version table and review the project's exact theme and PHP/server prerequisites. Do not infer exploitability from a version number alone.
- Remediate. Install the listed fix for the installed branch, or a supported successor containing it, through the WordPress update channel. Do not downgrade or switch branches merely to match a number in this historical table.
- Validate. Confirm core integrity and the installed fixed version, then test representative templates, login, editing, forms, and required integrations. Review unexpected PHP files, account changes, and persistence separately; version checks alone cannot establish recovery from compromise.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
