Hackers start exploiting critical WordPress flaw for code execution

Key Points:

• Threat actors have progressed from probing WordPress sites for the CVE-2026-87902 vulnerability to actively exploiting it by writing malicious files that execute shell commands when accessed.
• The initial reconnaissance began less than five hours after the patch release in WordPress 7.1.2, with malicious activity increasing tenfold as attackers attempt to deliver payloads.
• CVE-2026-87902 is a critical unauthenticated path traversal flaw that can lead to remote code execution if specific conditions involving theme directory names and readable PHP files are met, with a severity score of 9.2/10.
• The vulnerability affects WordPress versions down to 4.7 and certain PHP configurations, including the official PHP Docker image and default cPanel setups using PHP versions before 8.5; patches have been backported accordingly.
• Security firm Patchstack recommends immediate updating to WordPress 7.1.2, monitoring logs for suspicious activity, and blocking IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b due to observed exploitation attempts.