CVE-2026-87902 enters CISA KEV with WordPress patch deadline

CISA added WordPress Core CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on September 25, 2026. The entry gives covered U.S. federal civilian agencies a September 28 remediation deadline and requires forensic triage, making this an urgent patch and investigation item for WordPress operators.

What CISA lists for CVE-2026-87902

CISA describes a remote file inclusion flaw in WordPress Core. An unauthenticated attacker can influence page-template resolution so that WordPress includes a chosen readable local .php file outside the active theme directories. Under the relevant server and theme conditions, that can lead to remote code execution.

The KEV entry identifies the issue as WordPress Core, marks forensic triage as required, and sets the due date to September 28. CISA's catalog is the operational signal here: the vulnerability has moved from ordinary vulnerability management into the known-exploited queue.

Affected versions and the uncertainty to preserve

The NVD record lists WordPress versions earlier than 7.1.2 as affected and gives the issue a CVSS 3.1 score of 8.1 (High). It also records the vulnerability as deferred and reports a high attack complexity, so administrators should not treat the score alone as a prediction of easy exploitation.

The practical decision is narrower: verify the exact WordPress branch, installed build, active theme, server configuration, and available vendor fix. Do not assume that a managed host's automatic update completed across production, staging, containers, or frozen deployment images.

WordPress administrators should patch and investigate

• Confirm the running WordPress version and compare it with the vendor's fixed-release guidance; NVD's affected-version boundary is a starting point, not a substitute for vendor instructions.
• Prioritize internet-reachable sites and deployments using custom themes or unusual template-loading behavior.
• Review web-server, PHP, WordPress, and hosting-provider logs for unexpected template requests, local-file access, new PHP files, or changes to theme and plugin directories.
• Preserve relevant evidence before rebuilding or restoring a site, especially where a vulnerable site was exposed during the affected window.
• Recheck staging and backup images so an old WordPress build does not return during the next deployment.

What the KEV deadline means

The September 28 date is a binding remediation deadline for the U.S. federal civilian agencies covered by CISA's directive. Other site owners are not bound by that federal deadline, but the KEV listing is still a strong reason to move this issue ahead of routine WordPress maintenance.

Avoid exploit experimentation on production systems. Patch first, then use logs, file-integrity checks, backups, and endpoint telemetry to determine whether the site needs incident response. The unresolved detail is the exploitation pattern; the remediation priority is already clear.

Evidence

CISA's KEV feed is the primary source for the exploitation designation, deadline, and forensic-triage requirement. The NIST NVD record independently corroborates the WordPress Core scope, affected-version boundary, vulnerability mechanism, and severity data.