Loading story…
WordPress released fixes for CVE-2026-87902, a critical unauthenticated path-traversal/local file inclusion flaw affecting WordPress versions 4.7 through 7.1. The vulnerability abuses page-template resolution via get_page_template() to include attacker-selected readable PHP files outside the active theme directory. In susceptible server and theme configurations, this can enable remote code execution. WordPress 7.1.2 fixes the issue, with patches backported across supported branches; the flaw has a CVSS 3.1 score of 8.1.
Exploitation began shortly after the patch release, with observed traffic increasing tenfold from reconnaissance into attempts to write files to vulnerable servers, including marker payloads intended to identify hosts for subsequent operations. CISA reportedly added the vulnerability to its Known Exploited Vulnerabilities catalog on September 25. Administrators should apply the relevant WordPress update immediately; where remediation is delayed, restrict access and deploy compensating WAF controls. Teams should also review logs and the /tmp/ directory for suspicious files or activity that may predate patching.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
WordPress released version 7.1.2 on September 22, 2026, to fix CVE-2026-87902, a critical unauthenticated path-traversal/local-file-inclusion flaw. Fixes were also made available for maintained branches, while releases from 4.7 onward were affected.
Patchstack observed exploitation traffic rise tenfold within days of the patch release. The activity progressed from reconnaissance to writing files and marker payloads to targeted servers, apparently to identify hosts for later operations.
CSIRT Panama issued a public notice for CVE-2026-87902, assigning it a CVSS 3.1 score of 8.1 and advising organizations to patch, enable automatic updates, and investigate systems for pre-remediation compromise indicators.
CISA added the actively exploited WordPress Core vulnerability CVE-2026-87902 to the Known Exploited Vulnerabilities catalog.
Exploitation was observed within hours of the WordPress patch publication. Attackers used page-template manipulation to target vulnerable installations, with remote code execution possible in certain server and theme configurations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcecert.pa
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
WordPress released version **7.1.2** to fix critical vulnerability **CVE-2026-87902** / **GHSA-7hp8-65ch-5whp**, an improper filename-validation flaw (`CWE-98`) in `get_page_template()`. Under specific server and active-theme conditions, an unauthenticated attacker can influence page-template resolution to include a readable local PHP file outside the active theme directory, potentially resulting in remote code execution. Exploitation requires the top-level directory for the selected template to begin with `page-`, a condition reported in the Twenty Twelve and Twenty Fourteen themes as well as some third-party themes. The flaw carries a CVSS score of 9.2; administrators should update immediately to 7.1.2 or ensure automatic updates are enabled. Fixes are also being backported to security-supported WordPress releases from version 4.7 onward.
Sep 28, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026