WordPress Patches Critical CVE-2026-87902 RCE Exploited in the Wild

A critical vulnerability identified as CVE-2026-87902 has surfaced in WordPress core, prompting immediate patch advisories across enterprise environments. Under standard conditions, WordPress restricts PHP template loading strictly to defined directories within the active theme. CVE-2026-87902 bypasses these constraints, allowing unauthenticated attackers to supply crafted requests that force the inclusion and execution of arbitrary PHP files already present on the underlying host, culminating in remote code execution (RCE) on affected web servers. The flaw spans WordPress CMS versions 4.7.0 through 7.1.1, with remediated updates delivered across supported release branches up to version 7.1.2. This flaw represents an acute risk because active exploitation attempts were observed within hours of patch publication. While the underlying mechanism behaves similarly to path traversal, the presence of pre-existing or staged server artifacts transforms this inclusion into full remote code execution under typical PHP runtime configurations. Because user authentication is not required to initiate the file inclusion request, exposed corporate blogs, marketing portals, and headless CMS services are susceptible to compromise and host-level takeover if running vulnerable versions. The swift turnaround from patch availability to weaponization underscores the shrinking operational window security engineers have to respond to core web platform vulnerabilities. As automated threat tooling and scanner botnets immediately parse diffs and probe internet-facing assets, relying on scheduled patch cycles introduces substantial risk. Content management systems continue to represent high-value attack surfaces because they frequently sit at the edge of corporate networks, often bridged into internal infrastructure or holding sensitive application database credentials. Engineering and security teams should immediately upgrade WordPress deployments to version 7.1.2 or the patched maintenance release for their corresponding major branch. Beyond deploying updates, defenders must inspect access logs for indicators of compromise, including anomalous request paths, unexpected PHP file executions outside theme paths, and known malicious IP activity. Practitioners should also enforce strict file upload controls, limit execution permissions in upload directories (such as disabling script interpretation in `wp-content/uploads`), and restrict outbound network connectivity from web server runtimes to prevent lateral traversal.