Threat actors began actively exploiting CVE-2026-87902, a critical remote code execution vulnerability in WordPress core, within hours of the flaw’s public disclosure on September 24, 2026. The CVSS 9.2 vulnerability allows unauthenticated attackers to exploit the get_page_template() function to include chosen local PHP files, and attackers moved from initial probing of vulnerable sites to writing files that execute shell commands in a matter of hours.
CVE-2026-87902: Unauthenticated RCE via get_page_template() File Inclusion
CVE-2026-87902 targets the WordPress get_page_template() function, which attackers can manipulate to include arbitrary local PHP files. This type of vulnerability—often called local file inclusion—becomes remote code execution when attackers can control which file gets included and that file contains executable PHP code. Successful exploitation allows an unauthenticated attacker to run arbitrary commands on the web server hosting the WordPress installation.
The unauthenticated nature of the flaw significantly raises its severity. Attackers do not need stolen credentials, privileged access, or any interaction with the site administrator. Any WordPress installation exposed to the internet and running a vulnerable version can be exploited simply by sending a crafted HTTP request to the right endpoint. This accessibility makes the vulnerability an ideal target for mass scanning and automated exploitation campaigns.
Rapid Weaponization: From Disclosure to File-Writing Attacks in Hours
Security vendors reported that attackers began probing for vulnerable WordPress sites shortly after CVE-2026-87902 was publicly disclosed, and within hours escalated to writing files that execute shell commands on compromised servers. This rapid timeline—disclosure to active exploitation in the same day—demonstrates how quickly threat actors can develop working exploits once vulnerability details become public.
The progression from probing to file-writing attacks indicates attackers moved through multiple exploitation stages in compressed timeframe. Initial probes likely verified which sites were vulnerable and confirmed the attack worked. Once attackers confirmed exploitability, they deployed payloads that write web shells or backdoor scripts to the server’s file system, granting persistent remote access even if the vulnerability is later patched.
WordPress Patch Available as Exploitation Scales
WordPress released a patch for CVE-2026-87902, but the immediate exploitation following disclosure means many sites likely remain vulnerable. WordPress sites that have not applied the patch are actively under attack, and administrators must update immediately to prevent compromise. The confirmed active exploitation moves this from a theoretical risk to a verified in-the-wild threat affecting real WordPress installations.
Site administrators should also audit their WordPress installations for signs of compromise, particularly if the site was reachable and unpatched during the hours immediately after disclosure. Indicators include unexpected PHP files in web-accessible directories, new administrative accounts, or evidence of command execution in web server logs. Any site that was exposed and vulnerable between disclosure and patching should be treated as potentially compromised pending forensic review.
High Attacker Interest and the WordPress Target Landscape
The rapid weaponization of CVE-2026-87902 reflects the high value attackers place on WordPress vulnerabilities. WordPress powers a substantial portion of the internet’s websites, making any critical WordPress flaw a high-return target for attackers conducting mass compromise campaigns. An unauthenticated RCE in WordPress core is especially valuable because it affects all installations running vulnerable versions, not just those with specific plugins or themes installed.
Attackers exploiting WordPress vulnerabilities typically aim for one of several objectives: deploying web shells for persistent access, injecting malicious scripts into site content, harvesting credentials and data from the site’s database, or using the compromised server as infrastructure for further attacks. The file-writing capability documented in the CVE-2026-87902 exploitation fits the web shell deployment pattern, giving attackers a foothold they can use for any of these follow-on activities.
N-Day Exploitation Cadence and the Patch Deployment Race
CVE-2026-87902 follows a well-established N-day exploitation pattern in which attackers develop exploits as soon as vulnerability details are public and race defenders to compromise unpatched systems. The hours-long gap between disclosure and exploitation means site administrators had almost no time to patch before attacks began, creating conditions where even a fast patch deployment might not prevent compromise.
This compressed timeline underscores the importance of automatic updates for WordPress core. Sites configured to apply security updates automatically gain protection as soon as WordPress releases the patch, often before administrators are even aware a critical vulnerability was disclosed. Manual update processes introduce delay that attackers can exploit, and the CVE-2026-87902 timeline demonstrates that delay can be measured in hours, not days—far faster than many organizations’ patch testing and deployment cycles allow.
