1.0 Introduction
WordPress has released security updates to address a high-severity
vulnerability (CVE-2026-87902) affecting WordPress.
2.0 Impact
Successful exploitation of the local file inclusion vulnerability could
allow an unauthenticated attacker to include arbitrary code from a local
PHP file. If specific server and active theme conditions are met, successful
exploitation could lead to remote code execution.
3.0 Affected Product
·
WordPress core versions prior to 7.1.2
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review the
following advisories and apply the necessary updates:
Kindly refer to the following URL: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
Generally, we advise users to be updated with the latest
security announcements by the vendor and follow best practice security policies
to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident
Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References