CyberSecurity News

Critical WordPress Vulnerability Exploited Immediately After Disclosure

SecurityWeek

· September 24, 2026

AI summary

A critical vulnerability in WordPress, identified as CVE-2026-87902, has been exploited by attackers shortly after its disclosure. The flaw is a path traversal issue that enables remote, unauthenticated attackers to execute arbitrary code. This allows attackers to carry out malicious activities without needing authentication. The vulnerability was quickly taken advantage of by attackers following its public disclosure.

Vulnerabilities mentioned

CVE-2026-87902

HIGH

CVSS 8.1

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Read the full article at SecurityWeekwww.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to SecurityWeek.