WordPress Core Remote File Inclusion Actively Exploited
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2026-87902 WordPress RFI vulnerability is actively exploited in the wild; federal agencies must prioritize patching.
CISA has added CVE-2026-87902 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation of a remote file inclusion flaw in WordPress Core. This type of vulnerability is a frequent attack vector used by malicious cyber actors and poses significant risks to the federal enterprise and other organizations. The vulnerability enables total control of affected assets post-exploitation.
Federal Civilian Executive Branch (FCEB) agencies are required by Binding Operational Directive (BOD) 26-04 to prioritize rapid remediation of high-risk vulnerabilities, particularly those listed in CISA's KEV Catalog on publicly exposed assets. Organizations should treat this as an urgent patching priority and check for prior compromise before applying fixes. CISA encourages all organizations, regardless of sector, to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
Mentioned in this report
Detection guidance
WordPress PHP Request with Remote URL or Stream Wrapper in Query String
Detects web requests to WordPress PHP files whose query string carries a remote URL or PHP stream wrapper as a parameter value, the typical shape of a remote file inclusion attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WordPress PHP Request with Remote URL or Stream Wrapper in Query String
description: Detects requests to WordPress PHP paths where a query parameter value
is a remote URL (http, https, ftp) or a PHP stream wrapper (php, data, expect).
This is the typical shape of a remote file inclusion attempt. It generalises on
the parameter-value pattern, not on a specific parameter name or CVE string. Tune
by excluding known redirect parameters.
tags:
- attack.initial-access
- attack.t1190
- attack.command-and-control
- attack.t1105
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: /wp-
cs-uri-stem|endswith: .php
selection_rfi:
cs-uri-query|contains:
- =http://
- =https://
- =ftp://
- =http%3A%2F%2F
- =https%3A%2F%2F
- =ftp%3A%2F%2F
- =php://
- =php%3A%2F%2F
- =data://
- =data%3A%2F%2F
- =expect://
filter_login_redirect:
cs-uri-stem|endswith:
- /wp-login.php
- /wp-comments-post.php
condition: selection_path and selection_rfi and not filter_login_redirect
falsepositives:
- Plugins or themes that legitimately accept a URL parameter, such as oEmbed, import,
or SSO callback endpoints
- Security scanners run by the organisation against its own WordPress sites
level: medium
id: 5dd6997e-a7ac-5931-a6b5-0d29635c1f7b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-one-known-exploited-vulnerability-catalog
Web Server Process Spawning Download Utility on Linux
Detects a web server or PHP handler process launching curl or wget, a common post-exploitation step after file inclusion or RCE to pull a second-stage payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Download Utility on Linux
description: Detects Apache, nginx, httpd or PHP-FPM processes directly spawning curl
or wget. After a successful remote file inclusion or code execution on a WordPress
host, attackers commonly fetch additional tooling this way. Generalises on the parent/child
relation, not on any specific URL.
tags:
- attack.initial-access
- attack.t1190
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-cgi
- /php
Image|endswith:
- /curl
- /wget
condition: selection
falsepositives:
- WordPress plugins or cron-style PHP scripts that shell out to curl for health checks
or updates
- Deployment or monitoring scripts launched from a PHP handler
level: medium
id: 60aa3c8b-313b-503e-9f06-e63a3f5f0517
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-one-known-exploited-vulnerability-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-one-known-exploited-vulnerability-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs