Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Threat actors are exploiting a critical WordPress security flaw shortly after its public disclosure. The vulnerability, identified as CVE-2026-87902, has a CVSS score of 9.2 and could allow an unauthenticated attacker to achieve remote code execution. This flaw enables an attacker to make the get_page_template function include a chosen local .php file, potentially leading to malicious activity. The rapid exploitation of this vulnerability by threat actors highlights its severity and potential impact.