CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability

An official source reports active exploitation. Teams running WordPress Core should verify exposure and begin risk-reduction work now.

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

What changed

On September 26, 2026, this issue entered the urgent InfoSecNexus queue because exploitation is identified by an authoritative source. The source record, affected versions, and vendor remediation remain the controlling references; asset inventory and network context determine which systems should move first.

Why this matters

WordPress Core may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

Exploit-first prioritization does not mean patching blindly. Confirm the vulnerable component is installed, identify the reachable attack path, preserve evidence of suspicious activity, and protect critical workloads while the permanent fix is deployed.

Immediate response plan

1. Confirm the vulnerable plugin, component, route, role, and authentication state on every public application instance.
2. Apply the latest vendor remediation or isolate the vulnerable path when immediate patching is not possible.
3. Review web, WAF, authentication, process, and outbound-request logs for exploit indicators before cleanup.
4. Validate the fixed version and control health, then record any exception with an owner and expiry date.