A Vulnerability in WordPress Could Allow for Remote Code Execution

A vulnerability has been discovered in WordPress that could allow arbitrary code on the web server. WordPress is a free, open-source content management system (CMS) that allows you to build and manage websites without needing to write code. Successful exploitation allows an unauthenticated attacker to manipulate the page-template resolution logic to execute local PHP files outside the active theme directory, potentially leading to Remote Code Execution (RCE) under specific conditions.

Exploit code for CVE-2026-87902 is available in the wild and CISA added it to its Known Exploited Vulnerabilities (KEV) Catalog.

A vulnerability has been discovered in WordPress that could allow arbitrary code on the web server. Details of the vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation allows an unauthenticated attacker to manipulate the page-template resolution logic to execute local PHP files outside the active theme directory, potentially leading to Remote Code Execution (RCE) under specific conditions.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®