🔴 Critical: Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
-
Threat actors have started actively exploiting a critical WordPress vulnerability within hours of public disclosure. The flaw is tracked as CVE-2026-87902 and carries a CVSS score of 9.2, placing it in the critical severity range.
The vulnerability allows an unauthenticated attacker to achieve remote code execution (RCE). According to the disclosure, the issue arises because an unauthenticated attacker can make the get_page_template() page-template resolution include a chosen readable local .php file.
Key details:
- CVE ID: CVE-2026-87902
- Severity: CVSS 9.2 (critical)
- Impact: Remote code execution
- Attack vector: Unauthenticated
- Root cause: get_page_template() page-template resolution can be manipulated to include an attacker-chosen readable local .php file
- Exploitation status: Active exploitation observed within hours of disclosure
This rapid exploitation window underscores the importance of prompt patching and monitoring for signs of compromise on affected WordPress installations. Administrators should treat this as high priority given the unauthenticated nature of the flaw and the confirmed in-the-wild activity.
Source: The Hacker News
Has anyone seen exploitation attempts against their WordPress sites yet, and how are you mitigating in the absence of an immediate patch?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login