1.0 Introduction
Recently, WordPress has released an emergency security update addressing a
critical vulnerability in its Core software.
2.0 Impact
This vulnerability can allow an unauthenticated attacker to load arbitrary
local PHP files and, under specific server and theme conditions, achieve remote
code execution.
3.0 Affected Versions
- WordPress 7.1.0–7.1.1
- WordPress 7.0.0–7.0.5
- WordPress 6.9.0–6.9.8
- WordPress 6.8.0–6.8.9
- WordPress 6.7.0–6.7.8
- WordPress 6.6.0–6.6.8
- All corresponding affected branches back through WordPress 4.7.36
4.0 Recommendations
CyberSecurity Malaysia encourages
users and administrators to review the following advisories and apply the
necessary updates:
Kindly, please refer to the URL
below: https://socprime.com/blog/cve-2026-87902-critical-wordpress-core-rce-flaw/
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please
contact Cyber999 Incident Response Centre through the following channels:
E-mail:
cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References