CRITICALVulnerability
Global

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

·Source: The Hacker News

Updated:

Executive Summary

Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file

Analysis

Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file

Indicators of Compromise (1)

CVE (1)
CVE-2026-87902
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Sep 24, 2026.

Related Threats

LOWVulnerabilityNEW

The Fine Art of Frustrating the Adversary

What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependencies and resisting manufactured urgency.

Cisco Talos
MEDIUMVulnerability

Hackers stole Pentagon personnel records of over 3 million people

The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. [...]

BleepingComputer
MEDIUMVulnerability

AI Threats Top Cybersecurity Preparedness Gap, PwC Finds

PwC finds global security leaders are most concerned about attacks on AI systems

Infosecurity Magazine