CVE-2026-87902 — WordPress Core: WordPress Core Remote File Inclusion Vulnerability

1. Executive summary

CVE-2026-87902 is a remote file inclusion flaw in WordPress Core that lets an unauthenticated attacker force get_page_template() page-template resolution to include a readable local .php file outside the active theme directories, which leads to remote code execution. NVD records it at CVSS 8.1 HIGH (CWE-98), and CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-09-25, so exploitation is confirmed rather than theoretical. The Hacker News reports exploitation beginning within hours of disclosure, and SecurityWeek describes the same flaw as a path traversal issue, a classification discrepancy noted in §3. Any EMEA financial services firm running an internet-facing WordPress site is exposed, and the CISA KEV listing carries a remediation due date of 2026-09-28, which is two days from this advisory.

2. Regulatory framing

No other article in the regulatory reference is directly engaged by this item.

3. Technical analysis & attack chain

Confirmed steps, from the source material:

1. An unauthenticated attacker reaches the WordPress site over HTTP. No account and no user interaction are required.
2. The attacker makes get_page_template() page-template resolution include a chosen readable local .php file that sits outside the active theme directories.
3. The included file executes, giving remote code execution in the context of the web server process.

The vulnerability mechanism is remote file inclusion (CWE-98 per NVD). SecurityWeek describes the same flaw as a path traversal issue, and the two classifications can describe the same behaviour: the template-resolution path is traversed to reach a .php file outside the theme directory, and that file is then included. NVD's CWE-98 is the authoritative classification here.

The Hacker News reports a CVSS score of 9.2 for CVE-2026-87902. NVD records 8.1 HIGH. The verified NVD value is used throughout this advisory; the 9.2 figure is noted only as a discrepancy in the source reporting.

The source material does not give the affected WordPress version range, the fixed version, the exact request path or parameter used for CVE-2026-87902, any payload or implant capability, persistence mechanism, privilege escalation step, command-and-control channel, lateral movement, or exfiltration detail. None of that is stated in the provided sources and none is inferred here.

Two caveats on the surrounding material. First, the exploitation-in-hours claim rests on The Hacker News and SecurityWeek; the CISA KEV listing independently confirms exploitation occurred, but the timing claim is single-sourced to those outlets. Second, the related sources corpus-1, corpus-3, corpus-4 and corpus-6 describe CVE-2026-60137 and CVE-2026-63030, which are different WordPress Core vulnerabilities with their own KEV entries and due dates. The exploit request captured by SANS ISC (the POST /?rest_route=/batch/v1 batch-endpoint SQL injection with User-Agent: cve-2026-63030/1.0) belongs to CVE-2026-63030, not to CVE-2026-87902, and must not be treated as an indicator for this CVE. It is included in §5 only as a clearly labelled separate item because it shows WordPress Core exploitation activity in the same window.

4. Mitigation & containment

P1, within 24 hours:

• Identify every internet-facing WordPress Core installation and confirm its version. The source does not state which versions are affected by CVE-2026-87902 or which release fixes it, so treat any unpatched internet-facing WordPress Core as exposed until the vendor fix for this CVE is confirmed and applied. Apply the vendor mitigation in accordance with vendor instructions, as the CISA KEV entry directs.
• Where automatic updates are enabled, verify the site actually updated rather than assuming it did. WordPress maintainers force updates for affected installations with automatic updates enabled (stated for CVE-2026-63030 in the Rapid7 source, and the same verification discipline applies here).
• Treat any internet-facing WordPress host that cannot be confirmed patched as potentially compromised and begin triage. The CISA KEV entry references CISA's Forensics Triage Requirements; follow that guidance for hosts in scope.
• If mitigations are unavailable for a given host, follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product, per the KEV required action.

P2, within 72 hours:

• Review web server and application logs on all WordPress hosts for requests that reach template-resolution paths with traversal sequences or unexpected .php targets outside the active theme directory. The source does not give the exact request signature for CVE-2026-87902, so this is a behavioural hunt, not a signature match.
• On hosts where the REST API is exposed, review for the CVE-2026-63030 batch-endpoint pattern as a separate concern: POST /?rest_route=/batch/v1 with Content-Type: application/json and a User-Agent of cve-2026-63030/1.0. This is a different CVE and does not indicate CVE-2026-87902, but it indicates WordPress Core exploitation activity on the same estate.
• Confirm that file integrity monitoring covers the WordPress core, theme and plugin directories, and that any newly written .php file outside the expected theme paths is alerted on.

P3, within 7 days:

• Record CVE-2026-87902, its KEV status and the fixed version in the third-party risk register for WordPress Core, and confirm the firm's process for tracking upstream WordPress Core security releases where automatic updates are disabled.
• Re-test detection coverage for template-resolution abuse and for the batch-endpoint pattern across the estate.

5. Indicators of compromise

No atomic indicators for CVE-2026-87902 are present in the source material. The only concrete request artefacts in the corpus belong to CVE-2026-63030 and are listed separately below. They are single-sourced to SANS ISC and must be verified before enforcement.

user-agent  cve-2026-63030/1.0
url  hxxp://[hostname]/[.]?rest_route=/batch/v1
url  hxxp://[hostname]/wp/v2/posts

Behavioural indicators:

6. Detection

The sources give one usable artefact set, and it belongs to CVE-2026-63030 rather than CVE-2026-87902. The YARA rule below targets the distinctive strings from that captured exploit request. It will not detect CVE-2026-87902, for which the sources provide no artefact strings.

rule WordPress_Core_Batch_Endpoint_Exploit_CVE_2026_63030
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-26"
        reference = "https://isc.sans.edu/diary/rss/33168"
        description = "Detects the captured WordPress Core batch-endpoint exploit request associated with CVE-2026-63030. Not applicable to CVE-2026-87902."
    strings:
        $ua = "cve-2026-63030/1.0"
        $route = "rest_route=/batch/v1"
        $path = "/wp/v2/posts"
        $union = "UNION SELECT"
        $param = "author_exclude="
    condition:
        uint16(0) == 0x4850 or 3 of them
}

title: WordPress Core Batch Endpoint Exploitation Attempt (CVE-2026-63030)
id: 8f3c1a72-4d5e-4b91-9c07-2a6e5f0d1b34
status: experimental
description: Detects HTTP requests matching the captured WordPress Core batch-endpoint exploit pattern associated with CVE-2026-63030. This rule does not cover CVE-2026-87902.
author: Adverse Trace
date: 2026/09/26
references:

    - https://isc.sans.edu/diary/rss/33168
logsource:
    category: webserver
detection:
    selection_ua:
        cs-user-agent|contains: 'cve-2026-63030/1.0'
    selection_route:
        cs-uri-query|contains: 'rest_route=/batch/v1'
    selection_injection:
        cs-uri-query|contains:

            - 'author_exclude='
            - 'UNION SELECT'
    condition: selection_ua or (selection_route and selection_injection)
falsepositives:

    - Vulnerability scanners replaying the public proof of concept
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• NVD, CVE-2026-87902 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-87902, published 2026-09-24
• CISA Known Exploited Vulnerabilities, CVE-2026-87902, https://nvd.nist.gov/vuln/detail/CVE-2026-87902, KEV added 2026-09-25
• The Hacker News, Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure, https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html
• SecurityWeek, Critical WordPress Vulnerability Exploited Immediately After Disclosure, https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/
• SANS Internet Storm Center, WordPress Exploitation Underway (CVE-2026-63030), https://isc.sans.edu/diary/rss/33168, 2026-07-20
• Rapid7, CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core, https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core, 2026-07-17
• NVD, CVE-2026-60137 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-60137
• NVD, CVE-2026-63030 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-63030

8. Adverse Trace position

Adverse Trace assesses CVE-2026-87902 as CVSS 8.1 HIGH with confirmed exploitation, per the CISA KEV listing added 2026-09-25, and treats the 2026-09-28 KEV remediation due date as the operative deadline for any client with an internet-facing WordPress Core installation. The exploitation-timing claim and the 9.2 CVSS figure both come from single media sources and we do not rely on either; the KEV entry is the fact that matters. The affected and fixed version ranges for this CVE are not in the source material, so we cannot tell clients which release closes it, and we will not guess. We will obtain the vendor advisory and the fixed version numbers, re-issue this note with the version table, and confirm whether the CVE-2026-63030 batch-endpoint indicators overlap with any CVE-2026-87902 activity. Clients who cannot confirm their WordPress Core version and patch state on internet-facing hosts should treat those hosts as compromised and start triage today.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.