CVE-2026-87902 — WordPress Core Remote File Inclusion Vulnerability

The CISA Known Exploited Vulnerabilities (KEV) Catalog includes CVE-2026-87902, described as a WordPress Core remote file inclusion vulnerability. CISA describes the KEV Catalog as the authoritative source for vulnerabilities exploited in the wild and recommends that organizations use it to prioritize vulnerability management.