The vulnerability allows an unauthenticated attacker to achieve remote code execution (RCE). According to the disclosure, the issue arises because an unauthenticated attacker can make the get_page_template() page-template resolution include a chosen readable local .php file.

Key details:

• CVE ID: CVE-2026-87902
• Severity: CVSS 9.2 (critical)
• Impact: Remote code execution
• Attack vector: Unauthenticated
• Root cause: get_page_template() page-template resolution can be manipulated to include an attacker-chosen readable local .php file
• Exploitation status: Active exploitation observed within hours of disclosure

This rapid exploitation window underscores the importance of prompt patching and monitoring for signs of compromise on affected WordPress installations. Administrators should treat this as high priority given the unauthenticated nature of the flaw and the confirmed in-the-wild activity.

Source: The Hacker News

Has anyone seen exploitation attempts against their WordPress sites yet, and how are you mitigating in the absence of an immediate patch?