WordPress Core RCE Flaw CVE-2026-87902 Under Active Exploit

Exploitation confirmed. Attackers moved from reconnaissance to active file-write attacks on CVE-2026-87902 within hours of the public advisory, BleepingComputer reported September 23.

The flaw

CVE-2026-87902 is a path traversal bug in WordPress core. NVD published the record September 22, 2026. The mechanism: an unauthenticated attacker can manipulate get_page_template() page-template resolution to include a chosen readable local .php file from outside the active theme directories. Whether that reaches code execution depends on preconditions at both the server and the active theme. CVSS 8.1 High per NVD. Several outlets have cited a vendor-side score of 9.8 Critical; NVD’s score reflects the conditional nature of the RCE path.

Observed activity

Per BleepingComputer, attackers shifted from probing to writing files to disk that execute shell commands when accessed. Time from public disclosure to active exploitation: under 24 hours. Confidence: high, based on named sourcing and a specific behavioral description of the attack pattern.

Scope

Installs where server and active-theme conditions align with the preconditions described in the advisory. NVD’s record does not fully specify those preconditions or the affected version range. The vendor advisory is the authoritative source for version scope.

Patch

A fix is available, per SecurityWeek. WordPress core auto-updates cover it for sites that have not disabled automatic core updates. Sites that have not applied it: that gap is now being used.

Related: WordPress Core XSS Flaw Enables RCE via Admin Sessions, Elementor Pro Flaw Exploited to Backdoor WordPress Sites, CVSS 10 Flaw in WordPress Payment Plugin Grants Admin Access.