WordPress Core remote file inclusion flaw CVE-2026-87902 is actively exploited

A core flaw under active exploitation

A high-severity vulnerability tracked as CVE-2026-87902 has surfaced in WordPress Core, and according to Tenable's CVE tracking, cited in a dev.to analysis published on 17 October 2026, it is already being exploited in the wild. The flaw is classified as remote file inclusion, patches are available, and both the vendor alert and the analysis urge administrators to apply them promptly — as an emergency change rather than an item in a monthly maintenance window.

The exact scope is deliberately left to the primary source. The dev.to piece notes that the affected version range and the fixed release are spelled out in WordPress's own advisory, and that the advisory is the authoritative place to confirm the mechanism rather than inferring it from the vulnerability category.

What remote file inclusion means

Remote file inclusion is a class of bug in which an application can be induced to load content from a location its operator never intended — typically a remote server an attacker controls. The practical impact depends on how the included content is processed once it is loaded: in the worst cases such flaws can approach remote code execution, while in others the damage may be limited to data exposure or content injection. The dev.to analysis is careful here, warning that the label alone does not establish exactly what this bug allows, which is another reason to consult the official advisory.

Nearly eight million reachable installations

The headline number in the analysis comes from ZoomEye, a public asset search engine. A query on 1 October 2026 returned 7,982,191 assets matching a WordPress fingerprint.

The author is explicit about what that figure does and does not mean. It counts reachable installations identified by observable characteristics, not confirmed vulnerable instances, and it includes sites that are already patched, professionally managed, or hosted on platforms that push updates centrally.

Even so, the argument runs, the scale is the point. A flaw in core code ships with every WordPress installation, so the vulnerable population is large enough that automated exploitation will find targets without anyone deliberately targeting them. WordPress, described in the analysis as the most widely deployed content management system, is not uniquely fragile — it is simply everywhere — and its plugin and theme ecosystem adds layers of code that core updates never touch.

What administrators should do

The analysis sets out a practical checklist:

• Update WordPress Core to the fixed release, then confirm the running version from the dashboard.
• Work out whether the site can pull in remote resources through any configuration or plugin path, and switch that capability off if nothing needs it. Server-side rules blocking outbound requests from the web tier add a useful backstop.
• Look for signs of persistence that an update alone will not remove: altered core files, administrator accounts nobody recognises, injected scripts in the database and rogue scheduled tasks all require separate cleanup.
• Extend the same review to plugins and themes, since a core patch leaves the rest of the installation untouched.
• If you operate many sites, track versions site by site rather than for the fleet as a whole, because each installation stands or falls on its own version.

Why it matters

Most WordPress security news concerns a specific plugin or theme, which limits the exposed population to the sites that use it. A flaw in core is different: it is present in every unpatched installation regardless of configuration. Combine that with confirmed in-the-wild exploitation, a high severity rating and a reachable population measured in the millions, and the risk calculus changes — scanning begins immediately and continues indefinitely, so delay is what turns a flaw into an incident.

The dev.to analysis is honest about the limits of the data: exposure counts show what is visible from outside, and the vendor's exploitation status reflects what the vendor has observed; neither proves that any specific site was targeted. Both are nonetheless reason enough to patch now.