CVE-2026-87902

LLM-synthesized narrative grounded in this CVE's description and references.

• WordPress/WordPress2 versions

  cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 1 more

  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <4.7.37
  • (no CPE)

  Package: https://wordpress.org/plugins/wordpress
• WordPress/Wordpress Developllm-fuzzy
• osv-coords2 versions

  pkg:bitnami/wordpresspkg:bitnami/wordpress-multisite

  < 7.1.2+ 1 more

  • (no CPE)range: < 7.1.2
  • (no CPE)range: < 7.1.2

• github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whpnvdVendor Advisory
• patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/nvdThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

• WordPress 7.1.3 Security Release
  Patchstack Blog · Oct 6, 2026
• Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
  Wordfence Blog · Oct 1, 2026
• ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
  The Hacker News · Sep 28, 2026
• 28th September – Threat Intelligence Report
  Check Point Research · Sep 28, 2026
• Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
  Help Net Security · Sep 27, 2026
• Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code
  Cyber Security News · Sep 25, 2026
• WordPress CVE-2026-87902 Added to CISA KEV Under Active Exploitation
  Vypr Intelligence · Sep 25, 2026
• Critical WordPress Vulnerability Exploited Immediately After Disclosure
  SecurityWeek · Sep 24, 2026
• Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
  The Hacker News · Sep 24, 2026
• WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
  Help Net Security · Sep 23, 2026
• Critical WordPress Core Vulnerability Lets Attackers Execute Code Without Logging In
  Cyber Security News · Sep 23, 2026
• PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
  Wordfence Blog · Sep 22, 2026
• CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
  Patchstack Blog · Sep 22, 2026
• WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
  The Hacker News · Sep 22, 2026
• WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
  Patchstack Blog · Sep 22, 2026
• WordPress 7.1.2 Release
  WordPress Core Security · Sep 22, 2026
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA Alerts