Active Exploitation of Critical WordPress Vulnerability CVE-2026-87902 Reported Within Hours of Disclosure

Threat actors have begun actively exploiting a critical security flaw in WordPress within hours of public disclosure, according to recent reporting. The vulnerability, tracked as CVE-2026-87902, carries a CVSS score of 9.2 and involves a flaw in the get_page_template() function that mishandles page-template resolution. This allows an unauthenticated attacker to include a chosen readable local .php file, which could facilitate remote code execution (RCE).

The exploitation was first reported shortly after the public disclosure on September 24, 2026. Because the flaw allows unauthenticated access and potentially full system compromise, the speed of exploitation has raised significant concern among WordPress administrators and security professionals. Successful exploitation could allow an attacker to execute arbitrary code on the server, potentially leading to malware distribution, site defacement, or use as a pivot for further lateral movement within connected infrastructure.

WordPress core has been patched in version 6.6.2. Users running affected versions are strongly urged to update their installations as soon as possible. As of the time of reporting, no temporary workaround that fully mitigates the flaw without updating has been identified. The rapid emergence of active exploitation shortly after disclosure highlights the importance of prompt patch management for widely deployed platforms.