Back to the CVE list

CVE-2026-87902 CISA KEV · Actively exploited

Vulnerability in WordPress

CVSS score

8.1

EPSS probability

%40.0

Risk score

6.5

Published

27 d ago

Overview Public Exploits (7)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.8

CVE-2026-63030 Actively exploitedWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

Vendorwordpress Productwordpress

Workaround Public Exploits:1EPSS %113 mo ago

5.9

CVE-2026-60137 Actively exploitedWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

Vendorwordpress Productwordpress

WorkaroundEPSS %53 mo ago

8.8

CVE-2026-65640Unrestricted file upload in WordPress

Vendorwordpress Productwordpress

Patch status unknown Public Exploits:2EPSS %22 mo ago

8.9

CVE-2026-64638Cross-site scripting in WordPress

Vendorwordpress Productwordpress

Patch status unknown Public Exploits:9EPSS %12 mo ago

4.3

CVE-2023-39999WordPress < 6.3.2 is vulnerable to Broken Access Control

VendorWordPress.org ProductWordPress+4 etkilenen

Patch verifiedEPSS %13 y ago

-

CVE-2020-25213 Actively exploitedWordPress File Manager Plugin Remote Code Execution Vulnerability

Vendorwordpress ProductFile Manager Plugin

Workaround Public Exploits:13EPSS %975 y ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-87902"