A high-severity security flaw affecting WordPress Core has been disclosed and tracked as CVE-2026-87902. This vulnerability involves a remote file inclusion issue that site administrators and small business owners need to address promptly to maintain web application security.

### What Happened

According to security details, WordPress Core contains a remote file inclusion vulnerability. This flaw could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories. When successfully exploited, this behavior can lead to remote code execution on the affected server.

Notably, this issue carries a CVSS score of 8.1, classifying it as a high-severity risk. Furthermore, it has been officially added to CISA's Known Exploited Vulnerabilities (KEV) list, indicating that active exploitation may be occurring in the wild.

### Who Should Care

Small-business owners, webmasters, and agencies managing WordPress-based websites must pay close attention to this advisory. Because the vulnerability resides in WordPress Core and can be triggered by an unauthenticated attacker, any standard business site running vulnerable versions is potentially exposed to remote code execution risks.

### What to Do Now

Protecting your web assets from known vulnerabilities requires a consistent and proactive maintenance routine. Here are the practical steps you should take right now:

  • Check your current version: Review your WordPress installation to determine if your site runs an affected release of WordPress Core.
  • Apply official updates: Follow official vendor guidance from WordPress to update your core files as soon as security patches are available.
  • Review site integrity: Inspect your file directories and server logs for any unauthorized modifications or suspicious activity.
  • Run routine security checks: Regularly scan your digital perimeter to catch outdated components before they can be leveraged in an attack.

Stay informed about active threats and ensure your web properties remain secure against high-severity issues like CVE-2026-87902.

Ready to check your website security? Run a free check at Korisec.