Source: cisa.gov
WordPress Core contains a remote file inclusion vulnerability tracked as CVE-2026-87902. An unauthenticated attacker can exploit this flaw to manipulate page-template resolution, forcing it to include arbitrary readable local PHP files outside the active theme directories. This can lead to remote code execution without requiring authentication. The vulnerability has been documented in a GitHub Security Advisory (GHSA-7hp8-65ch-5whp) and listed in the NVD. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under the BOD 26-04 implementation guidance. The current risk level is rated High due to the potential for unauthenticated remote code execution on WordPress installations.
