WordPress CVE-2026-87902 Exploited Within Hours

Threat actors have commenced active exploitation of a critical security flaw within the WordPress content management system, with exploitation beginning mere hours after its public disclosure. The vulnerability, identified as CVE-2026-87902, carries a high severity rating with a CVSS score of 9.2, indicating a significant risk to affected systems. This critical flaw presents an opportunity for an unauthenticated attacker to achieve remote code execution (RCE) on vulnerable WordPress installations. The technical details of the exploit reveal that an unauthenticated attacker can leverage the `get_page_template()` function to include a chosen, readable local PHP file. This mechanism allows the attacker to inject malicious code or commands into the WordPress environment, potentially leading to full system compromise. The rapid exploitation underscores the urgency for WordPress users to apply security patches and updates as soon as they become available. WordPress, a widely used platform powering a substantial portion of the internet's websites, faces constant scrutiny from security researchers and malicious actors alike. The platform's popularity makes it a prime target for cyberattacks, necessitating a proactive approach to security management. The nature of this vulnerability, allowing RCE without prior authentication, is particularly concerning as it bypasses common security measures designed to protect against unauthorized access. Remote code execution is one of the most severe types of vulnerabilities, as it grants attackers the ability to run arbitrary commands on the target server, effectively taking control of the website and potentially the underlying infrastructure. This can lead to a wide range of malicious activities, including data theft, website defacement, the distribution of malware, and the use of the compromised server for further attacks. The disclosure of CVE-2026-87902 highlights the ongoing challenges in securing large-scale software platforms. Security researchers often discover and report vulnerabilities, and while responsible disclosure practices aim to give developers time to create and distribute patches, the window between disclosure and active exploitation can be very narrow. In this instance, the speed at which attackers began exploiting the flaw suggests that exploit code may have been developed in parallel with the vulnerability discovery or that the disclosure itself provided sufficient information for attackers to craft an exploit. WordPress users are strongly advised to monitor official WordPress security advisories and to implement any recommended patches or workarounds immediately. The specific function implicated, `get_page_template()`, is integral to how WordPress handles theme templates, and its misuse in this context allows for a dangerous deviation from intended functionality. The ability to include arbitrary local PHP files means that if an attacker can identify a readable PHP file on the server, they can potentially execute its contents as code. This could include configuration files, plugin files, or even core WordPress files, depending on the server's file structure and permissions. The implications for website owners are significant, ranging from minor disruptions to complete loss of control over their online presence. The ongoing battle between cybersecurity professionals and malicious actors necessitates constant vigilance and rapid response to emerging threats. The exploitation of CVE-2026-87902 serves as a stark reminder of the dynamic and ever-evolving threat landscape in the digital realm.