Is CVE-2026-87902 (WordPress Core Remote File Inclusion) being exploited in the wild?

Yes. CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalogue on 25 September 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

What the KEV listing means for WordPress Core exposure

CISA’s KEV catalogue is the key signal here because it reflects confirmed active exploitation, not just theoretical weakness. For WordPress Core, the practical question is whether you run a version path and configuration that can still resolve templates from an attacker-influenced file path, especially where custom themes, plugins, or legacy layout code widen the reachable surface.

If the site is internet-facing, treat the issue as operationally urgent even before you confirm direct exploitation. The inclusion in KEV means defenders should assume scanning, exploit attempts, and opportunistic chaining are already part of the threat environment.

How the remote file inclusion flaw becomes code execution

The core failure is not simply that a file can be included, but that page-template resolution can be steered toward a readable local .php file outside the intended theme boundary. When that file is executed in the WordPress runtime, the vulnerability stops being a content-routing problem and becomes a code-execution problem.

That distinction matters for triage. A local file inclusion path that only reads content is serious, but a path that can reach executable PHP can cross from disclosure into server-side execution, which changes the containment and recovery plan.

What defenders should check before calling it contained

Start with exposure confirmation: identify every WordPress Core deployment, then verify whether the site is actually reachable on the vulnerable path and whether any plugin, theme override, or template customisation expands the attacker’s options. If the vulnerable behaviour is present, the safest assumption is that hostile requests may already have been attempted, even if logs are incomplete.

The next check is compromise hunting. Review web server, application, and authentication logs for unusual template resolution requests, unexpected .php access, abrupt command execution, new admin accounts, web shells, or post-exploitation activity that appears after the suspected window. Where the application tier and the host share a filesystem, also inspect for modified PHP files and unexpected write locations.

Risk and Threat Considerations

This vulnerability creates a direct path from unauthenticated request handling to server-side execution, which means the main risk is not just website defacement but full compromise of the application host and any data or credentials reachable from it. Because CISA has placed it in KEV, defenders should assume active mass exploitation pressure rather than isolated research-only interest.

Failure mechanism: The attacker influences template resolution so WordPress includes a chosen readable local PHP file, then abuses the fact that included PHP executes in the web process context.

Impact: Successful exploitation can expose site content, session material, configuration secrets, admin credentials, database access, and in the worst case complete takeover of the WordPress server.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-16 — Application Software Security	WordPress Core exploitation is an application security exposure needing rapid remediation and verification.
Recommendation — Apply application security controls to identify, patch, and validate exposed WordPress instances.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A KEV-listed WordPress flaw requires prompt flaw remediation and exposure verification.
Recommendation — Prioritise patching and mitigation for the exploited WordPress vulnerability.
OWASP ASVS	V15 — Secure Coding and Architecture	Template inclusion leading to code execution is an application architecture weakness addressed by ASVS.
Recommendation — Review template resolution and file handling paths to prevent unsafe code inclusion.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	Active exploitation of a public WordPress flaw aligns with public-facing application exploitation.
Recommendation — Hunt for exploit attempts against the exposed WordPress application.
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Active exploitation calls for monitoring web and host telemetry for attack indicators.
Recommendation — Monitor web and host telemetry for abnormal WordPress exploitation activity.

Practitioner Guidance

What to prioritise: Treat remediation as a two-track job, reduce exposure first, then investigate whether the box was already touched. If the site is public, the best order is to verify the vulnerable build path, apply the vendor fix or mitigations, and only then do deeper forensics on the host and content tree.

What to verify: Confirm that no template include path can resolve outside the intended theme boundary, and check whether any security control depends on file-path filtering alone. That assumption is weak when the runtime can execute PHP from a readable local file.

Escalation / exception: If patching must wait, place the site behind the strongest available compensating control, restrict writable locations, and monitor for unexpected template resolution and PHP execution. If you find signs of web-shell behaviour or new persistence, treat the event as a host compromise, not just a vulnerable application.

Practitioner takeaway: For a KEV-listed file inclusion flaw, the decisive question is not whether exploitation is possible, but whether you can prove the vulnerable path is gone and the host stayed clean long enough to trust the system again.