CISA Warns of High-Severity WordPress Core Flaw Enabling Unauthenticated RCE

Key points

• CVE-2026-87902 affects WordPress Core and allows code execution without authentication.
• The flaw involves remote file inclusion during page-template resolution.
• CISA recommends applying mitigations, discontinuing use if needed, and evaluating internet exposure.
• No public exploit details yet, but severity is high.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about a high-severity weakness in the core software of WordPress. Tracked as CVE-2026-87902, the issue allows an attacker who has not logged in or authenticated to run arbitrary code on a vulnerable server. This is possible because the flaw involves the inclusion of files from remote locations during the process that resolves templates for pages. In effect, an unauthenticated actor can leverage this to execute code remotely.

Who is affected? Any organization running an unpatched version of WordPress Core that is reachable from the internet. That includes school districts, government agencies, and other entities using the platform. The vulnerability is rated high because it requires no credentials and can lead to full system compromise. CISA's guidance points to three immediate actions: implement available mitigations, stop using the affected product if mitigations are not possible, and assess how much of your installation is exposed to the internet.

Why does this matter? Remote code execution is among the most dangerous classes of bugs. An attacker could install backdoors, steal data, or pivot into internal networks. The page-template resolution vector is particularly concerning because it is a core function used by many themes and plugins. Even if your site does not use custom templates, the underlying code path may still be reachable.

Context: WordPress powers a large share of the web, including many K-12 and government sites. CISA's involvement signals that this is not a routine bug. While no widespread exploitation has been confirmed, the lack of authentication makes it attractive to automated scanners. Administrators should not wait for a patch if mitigations are available.

What to watch: Monitor for unusual file inclusions, unexpected outbound connections, or new administrative users. Keep an eye on WordPress security advisories and CISA updates for patch availability. If a fix is not released soon, consider temporarily taking the site offline or moving it behind a restrictive firewall.

What to do now

1. Inventory all WordPress Core installations and confirm which are internet-facing.
2. Apply any official mitigations or virtual patches from your WAF or hosting provider immediately.
3. If mitigations are unavailable, discontinue use of the affected WordPress Core version until a fix is released.
4. Evaluate internet exposure and restrict access to wp-admin and template resolution endpoints where possible.
5. Review logs for signs of remote file inclusion or unexpected code execution.
6. Enable auto-updates for WordPress Core and subscribe to CISA alerts for CVE-2026-87902.
7. If the site cannot be secured, consider migrating to a supported platform or isolating it from sensitive networks.

Original source

CISA Known Exploited Vulnerabilities