A critical remote code execution (RCE) vulnerability in WordPress, CVE-2026-87902, is being actively exploited by threat actors within hours of its public disclosure. The flaw allows an unauthenticated attacker to achieve RCE by manipulating page-template resolution to include a chosen local .php file. WordPress users are advised to apply patches immediately to prevent site compromise.