WordPress CVE-2026-87902: Unauthenticated RCE and File Inclusion Risk

En bref

• CVE-2026-87902 affects WordPress, with exposure traced to the 4.7 release line.
• Attackers need no credentials to trigger template-resolution weaknesses.
• Impact includes local file inclusion and remote code execution.
• A patch release is available; verify WordPress 7.1.2 and older branches.
• Exploitation activity and September 22 disclosure raise urgency.

On September 22, a high-severity security issue in WordPress was disclosed under the identifier CVE-2026-87902. The problem affects the platform’s template lookup process and can be reached by an attacker who has not logged in. According to the available details, the affected product set includes WordPress 7.1.2 and WordPress 4.7, with exposure present in releases from the 4.7 line onward. A patch release has been issued, but organizations must confirm that every instance is updated or otherwise protected.

The technical impact is serious. By manipulating how templates are resolved, an adversary may be able to cause the server to include local files or execute code remotely. Because no authentication is required, the attack surface is broad: any publicly reachable WordPress site running an unpatched version could be targeted. K-12 districts and government agencies often run WordPress for public communications, staff portals, and departmental sites, so a single neglected installation can expose sensitive data or become a foothold for lateral movement.

Exploitation is a key concern. The disclosure includes exploitation as an action, meaning defenders should assume that proof-of-concept code or active scanning may follow quickly. The fact that the flaw has existed since version 4.7 makes long-lived, unmaintained sites especially risky. Even if a site is not directly internet-facing, internal WordPress deployments can be used for phishing, credential theft, or persistence.

The patch is the primary mitigation. Administrators should treat CVE-2026-87902 as urgent, verify version status, and apply the vendor fix without delay. Where patching is not immediately possible, compensating controls such as web application firewall rules, access restrictions, and enhanced logging can reduce exposure. After patching, review logs for suspicious template-related requests and check for indicators of compromise.

What to watch: vendor updates, public exploit code, and any reports of mass scanning against WordPress endpoints. Because the issue is unauthenticated and tied to template resolution, defenders should monitor for unusual file inclusion attempts and unexpected code execution. Rapid patching and continuous monitoring remain the most effective defenses.

À faire maintenant

1. Inventory all WordPress instances and identify any running version 4.7 or later, including 7.1.2 and older branches.
2. Apply the vendor patch immediately; if patching is delayed, take affected sites offline or isolate them from untrusted networks.
3. Review web and application logs for unauthenticated requests that target template resolution, file inclusion paths, or unexpected PHP execution.
4. Deploy web application firewall rules to block directory traversal, template manipulation, and suspicious file inclusion attempts.
5. Restrict file permissions and remove unused themes or plugins that could be abused through the template lookup process.
6. Rotate credentials and secrets, and scan for webshells or persistence if compromise is suspected.
7. Monitor vendor advisories and threat intelligence for CVE-2026-87902 exploit activity and update response plans accordingly.

Références CVE

• CVE-2026-87902

Source originale

Security Affairs