# CISA Adds WordPress Vulnerability to Known Exploited Vulnerabilities Catalog A critical WordPress flaw allows remote code execution, prompting urgent fixes. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-26 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/5d00df08-ccfd-45dc-a9ea-30c8b3d2ad15 ## Critical WordPress Flaw Identified The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability, tracked as CVE-2026-87902, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, with a CVSS score of 9.2, allows unauthenticated attackers to exploit the get_page_template() function. Under specific server and theme conditions, it can lead to remote code execution, posing a significant security risk. ## Active Exploitation Observed Attackers are actively exploiting CVE-2026-87902 by using pearcmd.php to write malicious PHP files and execute code. This vulnerability affects every WordPress version from 4.7.0 onwards, spanning nearly a decade of releases. The flaw’s severity lies in its ability to bypass authentication, making it accessible to any attacker without requiring user credentials. ## WordPress Releases Patch WordPress has addressed the vulnerability in its latest release, version 7.1.2. The flaw stems from how the CMS resolves page templates, creating a pathway for remote code execution. Developers are urged to update their installations immediately to mitigate the risk of exploitation and secure their systems against potential attacks. ## Federal Agencies Ordered to Act CISA has mandated federal agencies to fix the vulnerability by September 24, 2026, under Binding Operational Directive (BOD) 22-01. This directive aims to reduce the risk posed by known exploited vulnerabilities. Private organizations are also encouraged to review the KEV catalog and address any identified vulnerabilities in their infrastructure to enhance their cybersecurity posture. ## Broad Impact Across Versions The vulnerability affects WordPress versions dating back to 4.7.0, highlighting a long-standing issue in the CMS’s template resolution mechanism. This widespread impact underscores the importance of timely updates and proactive vulnerability management to prevent exploitation across diverse WordPress installations. ## Discovery and Reporting The vulnerability was reported by Robert Ressl, who identified the flaw in WordPress’s core functionality. His discovery has led to urgent action by both WordPress developers and CISA, emphasizing the critical role of security researchers in identifying and mitigating vulnerabilities before they can be widely exploited. ## Recommendations for Organizations Experts recommend that organizations using WordPress review the KEV catalog and apply the necessary patches promptly. Additionally, they should monitor their systems for signs of exploitation and implement robust security measures to prevent unauthorized access and code execution. ## Importance of Proactive Security The addition of CVE-2026-87902 to the KEV catalog highlights the ongoing need for proactive vulnerability management. Organizations must prioritize regular updates, security audits, and adherence to directives like BOD 22-01 to safeguard their networks against evolving threats and ensure long-term cybersecurity resilience. ## Sources covering this story - https://securityaffairs.com/199790/security/u-s-cisa-adds-wordpress-flaw-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._