WordPress CVE-2026-87902 Added to CISA KEV Under Active Exploitation
CISA has added a critical WordPress vulnerability, CVE-2026-87902, to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation in the wild.
Key findings
- CISA added WordPress CVE-2026-87902 to its KEV catalog due to active exploitation.
- The vulnerability poses a significant risk to affected WordPress installations.
- Organizations must immediately patch CVE-2026-87902 to mitigate exploitation risks.
- Federal agencies are required to remediate this flaw by September 25, 2026.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert, adding a WordPress vulnerability, identified as CVE-2026-87902, to its authoritative Known Exploited Vulnerabilities (KEV) Catalog. This inclusion signifies that the flaw is under active exploitation by malicious actors in real-world attacks, elevating its urgency for immediate remediation across all affected WordPress installations. The KEV catalog serves as a definitive list of security weaknesses that pose significant risk and require prompt action from federal civilian executive branch (FCEB) agencies, but its guidance is crucial for all organizations.
CVE-2026-87902 represents a critical security bypass vulnerability within the WordPress ecosystem. While specific exploit details are not publicly disclosed, its presence in the KEV catalog confirms that attackers have successfully developed and deployed exploits targeting this flaw. Such vulnerabilities often allow unauthorized access, privilege escalation, or even arbitrary code execution, potentially leading to website defacement, data theft, or complete system compromise. The broad adoption of WordPress makes this vulnerability particularly impactful, as a vast number of websites could be at risk if not properly secured.
The addition of CVE-2026-87902 to the KEV catalog on September 25, 2026, mandates immediate action. For federal agencies, this means the vulnerability must be remediated by the KEV add date itself, underscoring the severe and immediate threat it poses. All organizations, regardless of their federal affiliation, are strongly advised to prioritize patching this vulnerability without delay. Proactive remediation is the most effective defense against the confirmed active exploitation of this flaw, preventing potential breaches and safeguarding digital assets.
Defenders should immediately identify all WordPress installations within their environment and apply the necessary security updates to address CVE-2026-87902. Beyond patching, organizations should also conduct thorough security audits to detect any signs of compromise that might have occurred prior to remediation. Implementing robust vulnerability management practices, including regular scanning and prompt application of security patches, is essential to maintain a strong security posture against actively exploited threats. Continuous monitoring for suspicious activity on WordPress sites is also recommended.