Security researchers have observed threat actors actively exploiting a critical security flaw in WordPress identified as CVE-2026-87902. The vulnerability, which carries a CVSS score of 9.2, was targeted by attackers within hours of its public disclosure. This security gap allows unauthenticated actors to potentially achieve remote code execution on affected systems.

The technical mechanism of the exploit involves the get_page_template() function. Specifically, an unauthenticated attacker can manipulate the page template resolution process to include a chosen readable local .php file. This file inclusion vulnerability provides a pathway for unauthorized users to execute arbitrary code without requiring prior access or credentials.

For IT directors and operations leaders, this rapid transition from disclosure to exploitation highlights the narrowing window for patching critical web infrastructure. Organizations utilizing WordPress must prioritize the identification of vulnerable instances to mitigate the risk of remote compromise and unauthorized system access.

The BroadVision view

This rapid exploitation cycle underscores the necessity for automated vulnerability management and immediate patching protocols. Mid-market teams should verify their web server configurations to prevent unauthorized file inclusion. Effective oversight of public facing assets remains a core component of maintaining secure strategic IT services.