As of yesterday, a critical vulnerability in WordPress has been actively exploited by hackers to execute code on vulnerable sites. The issue, identified as CVE-2026-87902, affects all versions of WordPress prior to 7.1.2 and allows attackers to write files to disk that can be used to execute malicious shell commands when accessed.
The vulnerability was discovered by security researcher Robert Ressl and is an unauthenticated path traversal bug that can lead to remote code execution (RCE) under certain conditions. According to the WordPress security team, the issue has a severity score of 9.2 out of 10, making it a high-priority fix.
To exploit the vulnerability, attackers need only target a local .PHP file within the active theme directories that is readable by the web server account. The researchers observed that hackers are using double-encoded traversal sequences in ‘pagename’ alongside a valid ‘page_id’ to probe for vulnerable sites.
Once a site is identified as vulnerable, the attackers move on to the next stage of the attack, which involves writing a payload file to disk. According to Patchstack, this can include files such as wp-pear-rce-flag.php or poc87902.php, which are delivered to /tmp and /var/tmp directories.
The WordPress security team has already addressed the issue with the release of version 7.1.2, but there’s a catch: releases prior to 4.6 will not receive a fix for this flaw. This means that millions of websites running older versions of WordPress are still vulnerable to attack.
Fortunately, Patchstack reports that website administrators can protect their sites by updating to the latest version of WordPress and reviewing their logs for malicious activity. The security firm also recommends adding the source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b to a blocklist.
The exploitation of CVE-2026-87902 highlights the importance of keeping WordPress up-to-date with the latest security patches. As hackers continue to probe for vulnerable sites, it’s essential that administrators prioritize their website’s security by taking immediate action to protect against this critical vulnerability.
In particular, users should be cautious when handling PHP files and ensure that their web server accounts have restricted access to sensitive directories. Regularly reviewing system logs and monitoring for suspicious activity can also help detect potential breaches before they occur.
Ultimately, the exploitation of CVE-2026-87902 serves as a stark reminder of the importance of website security in today’s digital landscape. By staying vigilant and taking proactive measures to protect against known vulnerabilities, administrators can significantly reduce their risk of falling victim to cyber attacks.
Source: Bleeping Computer — 2026-09-23