A Critical WordPress Flaw is Being Exploited by Hackers, Leaving Thousands of Sites Vulnerable
In a concerning development, hackers have begun exploiting a recently patched critical vulnerability in WordPress, allowing them to write files to disk that execute shell commands when accessed. The flaw, identified as CVE-2026-87902, was discovered by security researcher Robert Ressl and can lead to remote code execution (RCE) under certain conditions.
The WordPress security team has assessed the issue as having critical severity, with a score of 9.2 out of 10. This means that even if you’ve updated your website to the latest version of WordPress, you may still be at risk if you have an active parent or child theme with a top-level directory starting with “page-“. To make matters worse, the included file must also exist and be readable by the web server account.
According to security firm Patchstack, attackers initially probed vulnerable sites for reconnaissance purposes, but within hours of the patch being released in WordPress 7.1.2, malicious activity increased tenfold. The researchers observed that attackers were now trying to deliver payloads, which included writing files to disk and executing shell commands. While some payloads only marked the host as exploitable via CVE-2026-87902, others contained code that executed on access.
The observed probes used double-encoded traversal sequences in ‘pagename’ alongside a valid ‘page_id’, indicating that hackers are actively exploiting this flaw. Patchstack has identified three source IPs that should be added to your blocklist: 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.
Given the active exploitation of CVE-2026-87902, website administrators should update to WordPress version 7.1.2 as soon as possible and review their logs for malicious activity. This patch is not only available in the latest version of WordPress but has also been backported to all branches down to 4.7 due to its critical severity.
It’s essential to note that releases before 4.6 will not receive a fix for this flaw, leaving those sites vulnerable to exploitation. If you’re using a third-party plugin or theme, ensure it is up-to-date and compatible with the latest version of WordPress.
To protect your website from this vulnerability, follow these steps:
* Update your WordPress installation to version 7.1.2 or later.
* Review your logs for any signs of malicious activity.
* Ensure your active parent or child theme does not have a top-level directory starting with “page-“.
* Regularly update your plugins and themes to the latest versions.
Remember, prevention is key in cybersecurity. By staying informed and taking proactive measures, you can minimize the risk of falling victim to this critical vulnerability.
Source: Bleeping Computer — 2026-09-23