WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution

Attackers are currently targeting a critical WordPress flaw, CVE-2026-87902, which can lead to remote code execution (RCE). Researchers observed attempts to identify vulnerable websites within hours of the vulnerability's disclosure on September 22. Within five hours, attackers began probing vulnerable sites to determine if they could exploit the flaw.

By September 23, malicious traffic linked to the vulnerability had increased tenfold, with attackers attempting to write files that could execute shell commands. This rapid escalation highlights the narrow window for WordPress administrators to act, update their sites, and review for post-compromise activity. The vulnerability, a path traversal issue in WordPress Core's page-template resolution process, allows an unauthenticated attacker to include readable local PHP files located outside active theme directories.

WordPress has classified the vulnerability as critical, assigning it a 9.2 CVSS v4.0 score. It affects WordPress versions 4.7 through 7.1.1, with the most recent versions actively supported. Administrators are advised to update immediately to WordPress 7.1.2, which contains the fix for the current branch, and to apply security fixes for older branches if eligible.

Websites that were vulnerable during the exploitation window should inspect their systems for unexpected or modified files, particularly PHP files that could indicate code execution attempts.