Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
Threat actors actively exploit critical WordPress vulnerability CVE-2026-87902 (CVSS 9.2, RCE) within hours of public disclosure, with confirmed exploitation attempts targeting the platform.
- Threat actors actively exploit critical WordPress flaw CVE-2026-87902 within hours of disclosure.
- CVEs
- CVE-2026-87902
- ATT&CK
- T1566.001 Reconnaissance Against Public-Facing ApplicationT1570.001 Download and Exploit ApplicationT1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1048 Persistent File InjectionT1047 Create Log File
- Vendors
- WordPressPrevidianPatchstack
- Products
- WordPress
- Threat actors
- PrevidianPatchstack
- Malware
- PHP upload script
- Organizations
- PrevidianPatchstack
- Countries
- Indonesia
- AI models
- WordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.194.9.227 | with the malicious requests originating from an IP address (104.194.9[.]227) located in the U.S. state of New Jersey. These requests |
| ipv4 | 107.189.14.87 | ttacks - 43.250.53[.]42 180.251.159[.]243 195.178.110[.]247 107.189.14[.]87 45.61.184[.]170 92.246.130[.]76 In light of active exploi |
| ipv4 | 180.251.159.243 | addresses linked to the malicious attacks - 43.250.53[.]42 180.251.159[.]243 195.178.110[.]247 107.189.14[.]87 45.61.184[.]170 92.246. |
| ipv4 | 195.178.110.247 | to the malicious attacks - 43.250.53[.]42 180.251.159[.]243 195.178.110[.]247 107.189.14[.]87 45.61.184[.]170 92.246.130[.]76 In light |
| ipv4 | 43.250.53.42 | Some of the IP addresses linked to the malicious attacks - 43.250.53[.]42 180.251.159[.]243 195.178.110[.]247 107.189.14[.]87 45.61 |
| ipv4 | 45.61.184.170 | 53[.]42 180.251.159[.]243 195.178.110[.]247 107.189.14[.]87 45.61.184[.]170 92.246.130[.]76 In light of active exploitation, website |
| ipv4 | 92.246.130.76 | 159[.]243 195.178.110[.]247 107.189.14[.]87 45.61.184[.]170 92.246.130[.]76 In light of active exploitation, website administrators a |
From the original article
2 min read at thehackernews.com
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9. 2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.