Remote File Inclusion in WordPress Core (CVE‑2026‑87902) Enables Unauthenticated RCE
What It Is — WordPress Core contains a remote file inclusion (RFI) flaw that lets an unauthenticated attacker manipulate the page‑template resolver to load an arbitrary readable .php file located outside the active theme directory. Successful exploitation results in remote code execution on the web server.
Exploitability — The vulnerability is exploitable over the network without credentials. No public exploit code has been released, but the CVSS v3.1 base score is 9.8 (Critical), indicating a high likelihood of weaponisation.
Affected Products — All WordPress installations running a version prior to the vendor‑issued patch (see WordPress security advisory).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for a documented, continuously‑monitored patch‑management process that can provide audit‑ready evidence of timely remediation.
- Change & Configuration Control – Highlights gaps in configuration‑hardening controls; evidence of proper file‑system isolation and template‑resolution rules is a key control objective.
- Defensible Incident Evidence – If exploited, logs of file‑inclusion attempts become critical evidence for incident response and compliance reporting.
Recommended Actions
- Apply the WordPress security patch immediately; verify the version number after upgrade.
- Deploy a Web Application Firewall rule that blocks unexpected
?template=style parameters pointing outside the theme directory. - Enable and centralise PHP error and access logs; monitor for anomalous file‑inclusion attempts.
- Update your vulnerability‑management dashboard to flag RFI‑type findings and capture remediation timestamps as compliance evidence.
Source: CISA KEV – CVE‑2026‑87902