CVE-2026-87902Vulnerability

1. “CVE-2026-87902”

   SOCRadarVendor14 Oct 2026
   Top RCE Vulnerabilities

2. “CVE-2026-87902”

   Recorded FutureVendor13 Oct 2026
   September 2026 CVE Landscape

3. “Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-77179 (Docker), CVE-2026-93485, CVE-2026-87902 (WordPress), CVE-2026-89775 (Linux kernel), CVE-2026-93616, CVE-2026-85102 (Check Point), CVE-2026-93952 (Arista VeloCloud Orchestrator), CVE-2026-9…”

   The Hacker NewsNews28 Sep 2026
   ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

4. “WordPress has fixed CVE-2026-87902, a vulnerability affecting versions before 7.1.2 that allows unauthenticated attackers to include local PHP files outside active theme directories.”

   Check Point ResearchVendor28 Sep 2026
   28th September – Threat Intelligence Report

5. “CVE-2026-87902 WordPress Core Remote File Inclusion”

   Risky Business NewsNews28 Sep 2026
   Risky Bulletin: Intel ends paid bug bounties

6. “CVE-2026-87902”

   CERT-FRGovernment28 Sep 2026
   Bulletin d'actualité CERTFR-2026-ACT-041 (28 septembre 2026)

7. “CVE-2026-87902: how close is your WordPress to remote code execution?”

   Security AffairsNews27 Sep 2026
   Security Affairs newsletter Round 597 by Pierluigi Paganini – INTERNATIONAL EDITION

8. “WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)”

   Help Net SecurityNews27 Sep 2026
   Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

9. “Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog.”

   Security AffairsNews26 Sep 2026
   U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

10. “Open-source reporting indicates that CVE-2026-87902 is being exploited in the wild.”

    Canadian Centre for Cyber SecurityGovernment25 Sep 2026
    WordPress security advisory (AV26-952) – Update 1

11. “CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability”

    CISA advisoriesGovernment25 Sep 2026
    CISA Adds One Known Exploited Vulnerability to Catalog

12. “[WordPress // Previdian // Wordfence // WordPress CVE-2026-87902 on GitHub]”

    Risky Business NewsNews25 Sep 2026
    Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol

13. “Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-87902 misbruiken, om zonder authenticatie een lokaal PHP-bestand buiten de actieve themamappen door WordPress te laten inladen.”

    NCSC-NL advisoriesGovernment24 Sep 2026
    NCSC-2026-0389 [1.01] [M/H] Kwetsbaarheid verholpen in WordPress

14. “Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure”

    The Hacker NewsNews24 Sep 2026
    Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

15. “CVE-2026-87902 in WordPress Enables Conditional RCE”

    SOCRadarVendor23 Sep 2026
    CVE-2026-87902 in WordPress Enables Conditional RCE

16. “CVE-2026-87902: vulnerabilidad en la resolución de plantillas de página de WordPress.”

    INCIBE-CERTGovernment23 Sep 2026
    Inclusión de archivos PHP en WordPress

17. “Référence CVE CVE-2026-87902”

    CERT-FRGovernment23 Sep 2026
    Vulnérabilité dans WordPress (23 septembre 2026)

18. “WordPress rates the flaw as critical, assigns it a CVSS score of 9.2, and assigns it CVE-2026-87902.”

    The Hacker NewsNews22 Sep 2026
    WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

• third-party[.]comin 2 reports
• fbijobs[.]govin 2 reports
• 104.194.9[.]227in 2 reports

Also named with it: CVE-2026-93616, CVE-2026-94127, CVE-2026-85102, CVE-2026-88771, CVE-2026-88772, CVE-2026-65660, CVE-2026-67279, CVE-2026-5430, CVE-2026-93952, CVE-2026-7273, CVE-2026-60004, CVE-2026-48842, CVE-2026-76461, CVE-2026-28324, CVE-2026-71362, CVE-2026-32996, CVE-2026-33824