Our automated tracking framework flagged that CISA added CVE-2026-87902 (WordPress Core) to the Known Exploited Vulnerabilities (KEV) catalog on September 26, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-87902 by September 28, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-87902 |
| Vendor / product | WordPress Core |
| Vulnerability | WordPress Core Remote File Inclusion Vulnerability |
| CVSS base score | 8.1 |
| Added to KEV | September 25, 2026 |
| Days public before listing (NVD → KEV lag) | 3 |
| Federal patch deadline | September 28, 2026 |
| Known ransomware use | No |
How This Compares to WordPress’s Track Record
This one was public for just 3 days before CISA confirmed exploitation — faster than WordPress’s 212-day median, meaning attackers moved unusually quickly. WordPress currently ranks #23 on our KEV Lag leaderboard.
| WordPress in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 6 |
| Median lag (public → KEV listing) | 212 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1726 tracked KEV entries is 246 days — WordPress’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent WordPress KEV Additions
The most recent WordPress vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-60137 | Core | July 21, 2026 | 4 | No |
| CVE-2026-63030 | Core | July 21, 2026 | 4 | No |
| CVE-2019-9978 | Social Warfare Plugin | November 3, 2021 | 955 | No |
| CVE-2020-25213 | File Manager Plugin | November 3, 2021 | 420 | No |
| CVE-2020-11738 | Snap Creek Duplicator Plugin | November 3, 2021 | 569 | No |
What This Means for Defenders
CISA has added CVE-2026-87902, a WordPress Core vulnerability with a CVSS base score of 8.1, to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies must patch by September 28, 2026. The vulnerability was public for only 3 days before its KEV listing, indicating that exploitation began quickly and that there’s a narrow window for detection and mitigation. All organizations using WordPress Core should prioritize patching immediately.
Although there’s no known ransomware use, this type of vulnerability can be a prime target for initial access brokers and other threat actors. Patch WordPress Core installations before the September 28 deadline. If immediate patching isn’t possible, restrict network access to affected WordPress instances and deploy web application firewalls (WAFs) with rules to detect and block remote file inclusion attempts. Enhance monitoring for suspicious activity originating from WordPress servers until the patch is applied.
Related Coverage
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
