CISA Adds Critical WordPress Core Flaw CVE-2026-87902 to KEV Catalog

En bref

• CVE-2026-87902 affects WordPress Core.
• Unauthenticated attackers can exploit it for local file inclusion.
• CVSS score is 9.2 (critical).
• CISA added it to the KEV catalog.

A critical security vulnerability in WordPress Core, tracked as CVE-2026-87902, has been brought to attention by CISA. It enables local file inclusion and may be exploited by an unauthenticated attacker. Rated 9.2 on the CVSS base score, it falls under the critical severity classification.

The issue resides in WordPress Core, meaning that any site running an affected version is potentially at risk. Because exploitation does not require credentials, the attack surface is broad, and malicious actors could leverage it to read sensitive files on the server.

CISA's move to place this CVE on its Known Exploited Vulnerabilities (KEV) list highlights that the vulnerability is actively exploited in real-world environments. The KEV catalog serves as a warning to federal agencies and other organizations to prioritize patching.

Local file inclusion vulnerabilities allow an attacker to include and execute files that are already present on the server. In this case, the flaw enables reading a local file, which could expose configuration details, credentials, or other confidential data.

Given the critical severity and active exploitation, administrators should treat this as an emergency. Patching WordPress Core to the latest version is the primary mitigation. Until a patch is applied, additional protections such as web application firewalls or virtual patching may help.

What to watch: further details from WordPress about affected versions and patch availability, and any updates to the KEV entry. Monitoring for indicators of compromise related to local file inclusion attempts is also advised.

À faire maintenant

1. Immediately update WordPress Core to the latest patched version.
2. If patching is not possible, apply virtual patching via WAF rules to block local file inclusion attempts.
3. Review server logs for suspicious file inclusion requests targeting WordPress.
4. Restrict file permissions and ensure sensitive files are not readable by the web server.
5. Monitor CISA's KEV catalog and WordPress security advisories for updates.
6. Conduct a compromise assessment if you suspect exploitation.
7. Disable unnecessary WordPress features or plugins that might exacerbate the risk.

Références CVE

• CVE-2026-87902

Source originale

Security Affairs