CVE-2026-87902: Remote File Inclusion in WordPress Core, and the Scale Behind It

A flaw in the core of the most widely deployed content management system is not an ordinary vulnerability. Vendor research tracks CVE-2026-87902, a remote file inclusion issue in WordPress Core rated high, as exploited in the wild.

The vulnerability

The vendor alert classifies CVE-2026-87902 as a remote file inclusion flaw in WordPress Core and reports active exploitation, with patches available and a recommendation to apply them promptly. The affected version range and the fixed release are defined in the project's own advisory. Remote file inclusion is a category that allows an application to be induced to include content from a location the operator did not intend, and the practical impact depends on how that content is processed, so the advisory is the right place to confirm the mechanism rather than inference from the category name.

Scale changes the maths

Public asset measurement through ZoomEye, queried on 1 October 2026, reports 7,982,191 assets matching a WordPress fingerprint. That figure describes reachable installations identified by observable characteristics, not confirmed vulnerable instances, and it also includes sites that are patched, managed or hosted on platforms that apply updates centrally.
The scale is still the point. At this scale, a core flaw reaches a population large enough for automated exploitation to find targets without any targeting at all. WordPress is not uniquely fragile; it is simply everywhere, and its plugin and theme ecosystem adds tiers of code that core updates do not touch.

Response steps

• Update core to the fixed release and confirm the running version from the dashboard.
• Determine whether the site can include remote resources through any configuration or plugin path, and disable that capability where it is not required. Server-side controls that block outbound requests from the web tier provide a useful backstop.
• Check for persistence that survives the update. Modified core files, unexpected administrator accounts, injected scripts in the database and scheduled tasks require separate removal.
• Apply the same review to plugins and themes. A core patch does not clean the rest of the installation.
• For operators of many sites, track the version per site rather than per fleet, because the vulnerable unit is the individual installation.

The honest limit

Exposure counts describe what can be seen from outside, and the exploitation status in the vendor alert describes what the vendor has observed. Neither proves that a specific site was targeted. Both are sufficient reason to treat a core update as an emergency change rather than part of a monthly window, because at this population size the scanning starts immediately and does not stop.

References

1. Tenable CVE watch listing for CVE-2026-87902, https://www.tenable.com/cve
2. Tenable research alerts index, https://zh-cn.tenable.com/research
3. ZoomEye asset measurement, product fingerprint counts collected 1 October 2026, https://www.zoomeye.ai/