Unauthenticated Remote Code Execution in WordPress

A critical vulnerability (CVE-2026-87902) has been identified in WordPress that permits unauthenticated attackers to achieve remote code execution (RCE) on the underlying server. The flaw stems from an improper file handling mechanism that allows an attacker to bypass standard theme constraints and trigger the loading of files from unauthorized locations. When combined with other server-side configurations, this vulnerability can lead to full server compromise, allowing attackers to access, modify, or delete confidential data, and potentially utilize the host server for further malicious activities. While there are currently no reports of active exploitation or public exploit code, the severity of the potential impact necessitates immediate patching. Organizations are advised to verify their WordPress versions against the official vendor security advisory and apply the provided updates immediately.

Impact

Successful exploitation of CVE-2026-87902 grants an attacker the ability to execute arbitrary code with the privileges of the web server user. This can result in complete loss of confidentiality, integrity, and availability for the hosted WordPress site. Potential consequences include unauthorized data access or exfiltration, data manipulation, and the hijacking of the server for hosting malicious content or participating in further network attacks.

Recommendation

• Immediately identify and patch all WordPress instances to the version specified in the official WordPress security advisory.
• If the specific version is unknown, contact your IT service provider to audit the environment for vulnerable WordPress installations.
• Monitor web server logs for suspicious requests involving unexpected directory traversal or non-standard file loading patterns.