Core Crisis: Critical WordPress Path Traversal Flaw (CVE-2026-87902) Added to CISA KEV as Attackers Achieve Zero-Click Code Execution
Published on DigitalSpying.com | October 3, 2026
Author: DigitalSpying Threat Research Team
Threat Classification: Critical Web Application Vulnerability | Active In-The-Wild Remote Code Execution
Executive Summary
While the vast majority of WordPress security incidents stem from third-party plugins and neglected themes, vulnerabilities residing directly within WordPress Core represent an existential threat to the global web. This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a formal alert adding CVE-2026-87902 to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed evidence of widespread, automated exploitation in the wild.
First identified and mitigated in core maintenance releases by the WordPress security team and analyzed in depth by Wordfence and Aviatrix Threat Research, CVE-2026-87902 is a critical unauthenticated path traversal and Local File Inclusion (LFI) flaw residing within WordPress Core’s template resolution engine. An unauthenticated remote attacker can dispatch crafted HTTP requests that force WordPress to load and execute arbitrary PHP code situated outside active theme directories. With threat actors weaponizing the bug within hours of disclosure to deploy persistent web shells and hijack e-commerce sites, immediate verification of core update status is essential.
Technical Deep-Dive: Deconstructing the Template Resolution Exploit
1. The Vulnerable Mechanism: WordPress Template Hierarchy
In WordPress architecture, the template loader determines which PHP template file renders a given page based on incoming query parameters (e.g., single.php, page.php, or custom page templates assigned in post metadata):
* When a page or post specifies a custom template, WordPress invokes internal path-resolution functions to locate the template file within the active theme or child theme directories.
* The Sanitization Failure: Prior to the patch, the template resolution logic failed to properly sanitize path traversal sequences (../) when processing specific user-controlled query variables and template attributes passed via the REST API or legacy frontend query strings.
2. From Path Traversal to Remote Code Execution (RCE)
Under standard PHP configurations, file inclusion primitives (include or require) parse and execute PHP tags embedded inside any targeted file, regardless of its extension (.txt, .jpg, .png, or .log):
1. Staging the Payload: Attackers first upload a benign-looking file containing embedded PHP tags (e.g., a weaponized image with code in EXIF metadata, an avatar upload, or a text log file) into /wp-content/uploads/.
2. Triggering Template Resolution: The attacker sends an unauthenticated HTTP GET/POST request manipulating the page-template parameter with directory traversal sequences:
GET /?page_template=../../uploads/2026/10/avatar_payload.jpg HTTP/1.1
Host: target-wordpress-site.com
3. Arbitrary Code Execution: The unpatched template loader accepts the traversal path, resolves it to the physical file on disk, and passes it directly to require_once(). The PHP runtime parses the embedded script, granting the remote attacker immediate code execution under the privileges of the web server (www-data).
[Unauthenticated Attacker]
│
│ 1. Uploads polyglot image/file with embedded PHP (e.g., to /uploads/)
▼
[WordPress Core Frontend / REST API]
│
│ 2. Dispatches crafted request: ?page_template=../../uploads/payload.jpg
▼
[Vulnerable Template Resolution Logic (CVE-2026-87902)]
│
│ 3. Traversal escapes theme folder -> Resolves arbitrary local file
▼
[PHP Runtime: require_once('/path/to/uploads/payload.jpg')]
│
│ 4. Executes embedded PHP code
▼
[Remote Code Execution -> Drops Web Shell in /wp-content/]
3. Rapid Weaponization & Automated In-The-Wild Probes
Threat intelligence telemetry from Wordfence and Aviatrix highlights that automated exploitation began within hours of technical details circulating:
* Mass Spraying: Threat actors deployed automated scanning bots across IPv4 ranges, probing exposed WordPress installations for responsive template-override parameters.
* Payload Objectives: Attackers utilize the RCE foothold to drop secondary persistent web shells, modify .htaccess to redirect mobile traffic to fraudulent gambling or tech-support scam sites, and inject credit-card scrapers into WooCommerce checkout pages.
Industry & Web Ecosystem Impact
Because WordPress powers more than 43% of all websites globally, vulnerabilities in core code carry staggering scale:
* Universal Exposure: Unlike plugin bugs that only affect sites with a specific addon installed, CVE-2026-87902 resides in default WordPress core installations across all unpatched branches.
* Zero-Click Efficacy: No administrative credentials, user registration, or site interactions are necessary. Any public-facing WordPress site is directly exploitable if automatic background updates are disabled.
* CISA KEV Addition: CISA’s formal inclusion of CVE-2026-87902 into the KEV catalog mandates that all federal civilian agencies apply mitigations immediately, reflecting the acute threat to public and private web infrastructure.
Mitigation & Hardening Roadmap
Website administrators, hosting providers, and security teams must execute the following remediation measures immediately:
1. Verify Core Update Deployment
WordPress deployed automated security releases across all supported branches. Administrators must immediately confirm that their instances have updated:
* Ensure your installation is running the latest point release for your branch (e.g., WordPress 6.6.2, 6.5.6, 6.4.5, or earlier backported security releases).
* If background updates are disabled via define('AUTOMATIC_UPDATER_DISABLED', true); in wp-config.php, update immediately through the WordPress administrative dashboard or WP-CLI:
wp core update
2. Block PHP Execution in Uploads Directories
As a permanent architectural defense against file inclusion and web shell execution, configure web server rules to strictly prohibit PHP execution within user-writable media directories:
* For Nginx:
location ~* /wp-content/uploads/.*\.php$ {
deny all;
return 403;
}
* For Apache (.htaccess in /wp-content/uploads/):
Deny from all
3. Deploy Web Application Firewall (WAF) Filtering
Ensure edge WAFs (such as Cloudflare, AWS WAF, or Wordfence) have rules enabled blocking directory traversal patterns in query strings (../, %2e%2e%2f) targeting template parameters (page_template, template).
4. Post-Exploitation Triage & Integrity Auditing
If an unpatched site is suspected of compromise:
* Run a core file checksum verification using WP-CLI:
wp core verify-checksums
* Audit /wp-content/uploads/ for newly created .php files or hidden script wrappers.
* Review database user tables (wp_users) to ensure no unauthorized administrative accounts have been created.
References & Official Sources
* CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87902)
* Wordfence Threat Intelligence: Critical Unauthenticated Path Traversal in WordPress Core
* Aviatrix Threat Research Center: WordPress CVE-2026-87902 Exploited Within Hours
* NIST National Vulnerability Database (NVD): CVE-2026-87902 Detail