Hackers start exploiting critical WordPress flaw for code execution
Attackers are exploiting critical WordPress flaw CVE-2026-87902 for unauthenticated code execution.
Attackers are exploiting CVE-2026-87902, a critical unauthenticated path-traversal flaw in WordPress that can lead to remote code execution when certain theme and PHP conditions are met. WordPress scored it 9.2 and patched it in 7.1.2, backporting fixes through the 4.7 branch; versions before 4.6 remain unfixed. Patchstack said reconnaissance began within hours of the September 22 patch and later traffic shifted to writing PHP files that run shell commands. Site owners should update and check logs.
- CVE-2026-87902 is rated 9.2 and can lead to RCE.
- WordPress 7.1.2 fixes it, with backports through branch 4.7.
- Patchstack saw probing, then attackers writing executable PHP files.
- Releases before 4.6 will not be fixed.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- PatchstackWordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 169.58.48.193 | id.’ The source IPs that should be added to a blocklist are 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b. Given the active e |
| ipv4 | 169.58.48.195 | IPs that should be added to a blocklist are 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b. Given the active exploitation of |
From the original article
2 min read at bleepingcomputer.com
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.