CISA Adds WordPress Vulnerability to Known Exploited Vulnerabilities Catalog
A critical WordPress flaw allows remote code execution, prompting urgent fixes.
1Critical WordPress Flaw Identified
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability, tracked as CVE-2026-87902, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, with a CVSS score of 9.2, allows unauthenticated attackers to exploit the get_page_template() function. Under specific server and theme conditions, it can lead to remote code execution, posing a significant security risk.
2Active Exploitation Observed
Attackers are actively exploiting CVE-2026-87902 by using pearcmd.php to write malicious PHP files and execute code. This vulnerability affects every WordPress version from 4.7.0 onwards, spanning nearly a decade of releases. The flaw’s severity lies in its ability to bypass authentication, making it accessible to any attacker without requiring user credentials.
3WordPress Releases Patch
WordPress has addressed the vulnerability in its latest release, version 7.1.2. The flaw stems from how the CMS resolves page templates, creating a pathway for remote code execution. Developers are urged to update their installations immediately to mitigate the risk of exploitation and secure their systems against potential attacks.
4Federal Agencies Ordered to Act
CISA has mandated federal agencies to fix the vulnerability by September 24, 2026, under Binding Operational Directive (BOD) 22-01. This directive aims to reduce the risk posed by known exploited vulnerabilities. Private organizations are also encouraged to review the KEV catalog and address any identified vulnerabilities in their infrastructure to enhance their cybersecurity posture.
5Broad Impact Across Versions
The vulnerability affects WordPress versions dating back to 4.7.0, highlighting a long-standing issue in the CMS’s template resolution mechanism. This widespread impact underscores the importance of timely updates and proactive vulnerability management to prevent exploitation across diverse WordPress installations.
6Discovery and Reporting
The vulnerability was reported by Robert Ressl, who identified the flaw in WordPress’s core functionality. His discovery has led to urgent action by both WordPress developers and CISA, emphasizing the critical role of security researchers in identifying and mitigating vulnerabilities before they can be widely exploited.
7Recommendations for Organizations
Experts recommend that organizations using WordPress review the KEV catalog and apply the necessary patches promptly. Additionally, they should monitor their systems for signs of exploitation and implement robust security measures to prevent unauthorized access and code execution.
8Importance of Proactive Security
The addition of CVE-2026-87902 to the KEV catalog highlights the ongoing need for proactive vulnerability management. Organizations must prioritize regular updates, security audits, and adherence to directives like BOD 22-01 to safeguard their networks against evolving threats and ensure long-term cybersecurity resilience.