Critical WordPress CVE
https://github.com/abraxas/CVE-2026-87902
CVE-2026-87902 is a critical unauthenticated WordPress Core LFI affecting versions through 7.1.1; under certain conditions it can lead to code execution. Practical fix: **upgrade WordPress Core to 7.1.2 or later immediately**, a WAF rule is only a temporary mitigation.
[https://wordpress.org/news/2026/09/wordpress-7-1-2-release/](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
https://stacker.news/items/1580195
m0wer
npub1w3…t4c5c
2026-09-23 13:26:37 UTC
Author Public Key
npub1w3vaxva0vcrx7pnvlpmede5smvafdl69xnu7ma82kaxl9us89zdsht4c5cSeen on
wss://relay.damus.ioPublished at
2026-09-23 13:26:37 UTCEvent JSON
{
"id": "72f21c77121257e4af19a5a878ea9ee047dbff382d928135b184ed8b1e1fc2d7",
"pubkey": "7459d333af66066f066cf87796e690db3a96ff4534f9edf4eab74df2f207289b",
"created_at": 1790169997,
"kind": 1,
"tags": [
[
"client",
"stacker.news"
]
],
"content": "Critical WordPress CVE\nhttps://github.com/abraxas/CVE-2026-87902\n\nCVE-2026-87902 is a critical unauthenticated WordPress Core LFI affecting versions through 7.1.1; under certain conditions it can lead to code execution. Practical fix: **upgrade WordPress Core to 7.1.2 or later immediately**, a WAF rule is only a temporary mitigation.\n\n[https://wordpress.org/news/2026/09/wordpress-7-1-2-release/](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)\n\nhttps://stacker.news/items/1580195",
"sig": "5833b19d50a60e918e2392b53c0ef755455b377f7079d2ab1dc6f5f3561a55aac5fd5fe396858f1b9406bdc7d6f1f3dfeac140f0c05cc3c96bd131fdcc0f4510"
}