https://vulnerability.circl.lu/sightings/feed 2026-09-24T08:50:36.175397+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4c0de4ac-c734-4827-b5ab-468d598cac87/export 2026-09-24T08:50:36.194185+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4c0de4ac-c734-4827-b5ab-468d598cac87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/2k115.bsky.social/post/3mwauh27fe22e", "content": "CVE-2026-87902: unauthenticated file inclusion in WordPress core (4.7.0\u20137.1.1), patched in 7.1.2 (CVSS 9.2). Can lead to RCE under specific server setups. Exploitation attempts detected within hours of release. Update now.\n\u200b#InfoSec #CyberSecurity #WordPress", "creation_timestamp": "2026-09-24T08:44:05.052438Z"} 2026-09-24T08:44:05.052438+00:00 https://vulnerability.circl.lu/sighting/b18896d6-a0d3-4596-abe5-e6eb019aeb91/export 2026-09-24T08:50:36.195817+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b18896d6-a0d3-4596-abe5-e6eb019aeb91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwaudxfycs2v", "content": "Alright Morty. WordPress shipped CVE-2026-87902, CVSS 9.2, so get_page_template can yoink pearcmd.php and gift unauthenticated RCE. Exploiters started the same day as 7.1.2. Your blog's page-templates folder is the open bar. day267.018", "creation_timestamp": "2026-09-24T08:42:22.032190Z"} 2026-09-24T08:42:22.032190+00:00 https://vulnerability.circl.lu/sighting/4b35468b-160e-43c2-aaf1-28d6e70b59d2/export 2026-09-24T08:50:36.195955+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4b35468b-160e-43c2-aaf1-28d6e70b59d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwatytjqc72z", "content": "CVE-2026-87902 enables unauthenticated remote code execution in WordPress when specific theme and readable local PHP file conditions are met.\n", "creation_timestamp": "2026-09-24T08:36:06.905971Z"} 2026-09-24T08:36:06.905971+00:00 https://vulnerability.circl.lu/sighting/78af0b58-34ac-49d9-907e-bdebb80e7bbe/export 2026-09-24T08:50:36.196066+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "78af0b58-34ac-49d9-907e-bdebb80e7bbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwatxjd4th2i", "content": "CVE-2026-87902 enables unauthenticated remote code execution in WordPress when specific theme and readable local PHP file conditions are met.\n", "creation_timestamp": "2026-09-24T08:35:22.358751Z"} 2026-09-24T08:35:22.358751+00:00 https://vulnerability.circl.lu/sighting/1d20e33e-93ee-4084-9e8d-3f6459321e18/export 2026-09-24T08:50:36.196166+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1d20e33e-93ee-4084-9e8d-3f6459321e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/2k115.bsky.social/post/3mwass2m3is2l", "content": "CVE-2026-87902: an unauthenticated file inclusion flaw in WordPress core (4.7.0\u20137.1.1), patched in 7.1.2. It can lead to RCE under specific server configurations. Active exploitation attempts began hours after the fix.", "creation_timestamp": "2026-09-24T08:14:25.038254Z"} 2026-09-24T08:14:25.038254+00:00 https://vulnerability.circl.lu/sighting/d194755c-81eb-44c5-b8bd-40f2e8b4b4a6/export 2026-09-24T08:50:36.196264+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d194755c-81eb-44c5-b8bd-40f2e8b4b4a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwaq4o5kqp2x", "content": "WordPress\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u516c\u958b\u76f4\u5f8c\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u308b\n\n\u516c\u958b\u3055\u308c\u305f\u3070\u304b\u308a\u306eWordPress\u306e\u8106\u5f31\u6027\u304c\u516c\u958b\u304b\u3089\u6570\u6642\u9593\u4ee5\u5185\u306b\u60aa\u7528\u3055\u308c\u59cb\u3081\u3001\u3059\u3067\u306b\u5b9f\u969b\u306e\u4fb5\u5bb3\u306b\u307e\u3067\u767a\u5c55\u3057\u3066\u3044\u308b\u3068\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696dPatchstack\u304c\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002 CVE-2026-87902\uff08CVSS\u30b9\u30b3\u30a29.2)\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001WordPress\u306e\u30da\u30fc\u30b8\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u89e3\u6c7a\u51e6\u7406\u306b\u5b58\u5728\u3059\u308b\u30d1", "creation_timestamp": "2026-09-24T07:26:40.149276Z"} 2026-09-24T07:26:40.149276+00:00 https://vulnerability.circl.lu/sighting/58cb814c-92ad-4364-a72e-1b413ce22e6d/export 2026-09-24T08:50:36.196364+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "58cb814c-92ad-4364-a72e-1b413ce22e6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwaq4f7kqz2n", "content": "CVE-2026-87902 enables unauthenticated path traversal leading to remote code execution in affected WordPress setups.\n", "creation_timestamp": "2026-09-24T07:26:30.950431Z"} 2026-09-24T07:26:30.950431+00:00 https://vulnerability.circl.lu/sighting/aace7490-3cd0-4689-8a8b-6e8b79d47baa/export 2026-09-24T08:50:36.196460+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "aace7490-3cd0-4689-8a8b-6e8b79d47baa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwaq4afbjg2c", "content": "CVE-2026-87902 enables unauthenticated path traversal leading to remote code execution in affected WordPress setups.\n", "creation_timestamp": "2026-09-24T07:26:25.888072Z"} 2026-09-24T07:26:25.888072+00:00 https://vulnerability.circl.lu/sighting/35253ad2-7502-4ff0-96e4-10a040751039/export 2026-09-24T08:50:36.196556+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "35253ad2-7502-4ff0-96e4-10a040751039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwanmp5ywy2a", "content": "Top 3 CVE for last 7 days:\nCVE-2026-86296: 25 interactions\nCVE-2026-7273: 20 interactions\nCVE-2026-58704: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-94127: 10 interactions\nCVE-2026-69836: 7 interactions\nCVE-2026-87902: 7 interactions\n", "creation_timestamp": "2026-09-24T06:41:57.630290Z"} 2026-09-24T06:41:57.630290+00:00 https://vulnerability.circl.lu/sighting/e698a0ee-13c2-4842-bd3d-2c04fd9c0654/export 2026-09-24T08:50:36.196656+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "e698a0ee-13c2-4842-bd3d-2c04fd9c0654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "exploited", "source": "https://t.me/thehackernews/10148", "content": "\u26a1 Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure.\n\nThe attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met.\n\n\ud83d\udd17 How the exploit works \u2192 https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html", "creation_timestamp": "2026-09-24T05:57:05.000000Z"} 2026-09-24T05:57:05+00:00