CVE-2026-87902 · Critical · CISA KEV

WordPress Core RFI: Unauthenticated RCE via Template Inclusion (KEV)

Threat Engine Auto-Feed · data current as of 2026-09-26

WordPress Core is vulnerable to remote file inclusion, enabling unauthenticated attackers to achieve remote code execution. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, and has a high EPSS percentile, indicating significant exploitation probability.

  • CVSS:
  • EPSS percentile: 0.97111
  • Exploitation pressure: 83/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 97th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability allows an attacker to trick the system into including a file from an unintended location on the server. If the attacker can control which file is included, and that file contains malicious code, the system will execute that code, potentially giving the attacker full control.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using WordPress Core, especially those with public-facing instances.
  • Financial services and Technology sectors, due to assessed targeting by relevant threat actors.

Misconfigurations that escalate it

  • Improper file permissions that allow attackers to place or manipulate local PHP files.
  • Lack of robust input validation and sanitization for template-related functions.

High-impact scenarios

  • Unauthenticated remote code execution, leading to full compromise of the WordPress instance and underlying server.
  • Data theft, website defacement, or deployment of further malicious payloads (e.g., ransomware, backdoors).
  • Lateral movement within the network if the compromised WordPress server has elevated privileges or access to other systems.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor WordPress access logs for unusual file inclusion attempts or requests for non-standard PHP files.
  • Implement Web Application Firewall (WAF) rules to detect and block suspicious file inclusion patterns.
  • Regularly scan WordPress installations for known vulnerabilities and indicators of compromise.

Contain

  • Isolate affected WordPress instances from the rest of the network.
  • Disable or restrict access to the compromised WordPress site immediately if exploitation is suspected.
  • Review and revoke any potentially compromised API keys, database credentials, or user accounts associated with the WordPress instance.

Patch

  • Apply the latest security patches and updates for WordPress Core as soon as they become available.
  • Ensure all themes and plugins are also updated to their latest secure versions.

Frontier verdict — Critical

Critical priority due to confirmed in-the-wild exploitation (CISA KEV) and high EPSS, enabling unauthenticated remote code execution on WordPress Core.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.