CVE-2026-87902: Remote File Inclusion in WordPress Core

A high-severity remote file inclusion flaw, CVE-2026-87902, has been found in WordPress Core, with the vendor reporting active exploitation and releasing patches. ZoomEye counted 7,982,191 WordPress-fingerprinted assets as of October 1, 2026.

• CVE-2026-87902 is a high-rated remote file inclusion flaw in WordPress Core
• Vendor reports active exploitation and has shipped patches
• ZoomEye counted 7,982,191 WordPress assets as of October 1, 2026
• Core patch does not cover plugins and themes, which need separate review