The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated urgent patching for a critical WordPress Core vulnerability after adding it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, reported as CVE-2026-87902 with a CVSS score of 9.2, is under active exploitation and poses a severe risk to websites worldwide. Readers are advised to verify the CVE identifier against the official CISA KEV catalog or NVD, as the year-prefix is inconsistent with current timelines and may reflect a data-entry error in initial reporting.

Security researchers identified the vulnerability as a Local File Inclusion (LFI) flaw in the get_page_template() function. It allows unauthenticated remote attackers to potentially read sensitive server-side files or escalate their access. Its addition to CISA's KEV catalog signifies confirmed malicious use in the wild, triggering mandatory remediation deadlines for U.S. federal agencies under Binding Operational Directive 22-01.

Although the directive's legal force applies to U.S. federal systems, the severity and active exploitation of this flaw make it an urgent priority for any organization running a WordPress site. Threat actors exploiting this vulnerability operate globally, and administrators everywhere should treat this advisory as a critical action item requiring immediate attention.

Immediate Action Checklist for WordPress Administrators
  1. Identify Your Version: Check your current WordPress version by navigating to Dashboard > Updates. All versions of WordPress 6.7.x, 6.6.x, 6.5.x, and earlier are vulnerable.
  2. Apply the Official Patch: Update your site immediately to the latest stable release from the official WordPress repository. Always perform a full backup of your site and database before updating.
  3. Confirm the Update: Verify the new version is active in the Dashboard > Updates section after updating. Employ security plugins or manual checks to confirm that the core files have been patched.
  4. Harden Your Environment: Ensure all plugins and themes are updated to their latest versions. Review user permissions and consider deploying a Web Application Firewall (WAF) for an additional layer of protection.
  5. Monitor for Signs of Compromise: After patching, audit server logs for unusual file access patterns or failed inclusion attempts, which may indicate prior exploitation.

The convergence of a high-severity rating, unauthenticated attack vector, and confirmed real-world exploitation makes patching this WordPress vulnerability an essential and time-sensitive task for maintaining web security. Administrators should apply the patch without delay.

美國網絡安全和基礎設施安全局（CISA）在將一個關鍵的 WordPress 核心漏洞加入其「已知被利用漏洞」目錄後，已下令要求緊急修補。據報告，該漏洞編號為 CVE-2026-87902，CVSS 評分為 9.2，目前正遭受活躍利用，對全球網站構成嚴重風險。鑑於該 CVE 編號的年份前綴與當前時間線不符，可能反映初步報告中的資料輸入錯誤，讀者應參照 CISA KEV 目錄或國家漏洞資料庫（NVD）核實該 CVE 編號。

安全研究人員確認該漏洞為 get_page_template() 函數中的本地檔案包含（LFI）漏洞。它可能允許未經認證的遠程攻擊者讀取敏感的伺服器端檔案或提升其權限。將其加入 CISA 的 KEV 目錄，意味著在野外已確認存在惡意利用，這觸發了美國聯邦機構在約束性操作指令 22-01 下的強制性補救期限。

雖然該指令的法律效力適用於美國聯邦系統，但此漏洞的嚴重性及其活躍利用狀況，使其成為任何運行 WordPress 站點組織的緊急優先事項。利用此漏洞的威脅參與者在全球範圍內活動，各地管理員都應將此公告視為需要立即關注的關鍵行動項目。

WordPress 管理員立即行動清單
  1. 確認您的版本： 前往 控制台 > 更新 檢查您當前的 WordPress 版本。WordPress 6.7.x、6.6.x、6.5.x 及更早版本均受影響。
  2. 套用官方修補程式： 立即將您的站點更新至官方 WordPress 資料庫中的最新穩定版本。更新前請務必對您的站點及資料庫進行完整備份。
  3. 確認更新： 更新後在 控制台 > 更新 部分驗證新版本已生效。使用安全插件或手動檢查以確認核心檔案已被修補。
  4. 加固您的環境： 確保所有插件和主題已更新至最新版本。檢查用戶權限，並考慮部署 Web 應用程式防火牆（WAF）以提供額外一層保護。
  5. 監控入侵跡象： 修補後，審計伺服器日誌以查找異常的檔案存取模式或失敗的包含嘗試，這可能表明先前曾遭受利用。

高嚴重性評級、未經認證的攻擊向量以及已證實的現實世界利用，這三者的交匯使得修補此 WordPress 漏洞成為維護網絡安全的一項必要且緊迫的任務。管理員應毫不延遲地套用修補程式。

新聞來源 / Original News Source