Hackers have started actively exploiting a critical WordPress flaw that can let them run commands on vulnerable websites. The bug, CVE-2026-87902, is an unauthenticated path traversal issue in WordPress fixed in version 7.1.2 and backported to supported branches down to 4.7. Patchstack says attacks escalated from reconnaissance within hours of disclosure to payloads that write PHP files into /tmp and /var/tmp for command execution, with exploitation depending on theme layout and reachable local PHP files such as pearcmd.php.
Why it matters: WordPress powers a huge share of websites, so active exploitation of a critical no-login flaw is urgent for site owners and hosting providers. Administrators should update to WordPress 7.1.2 or the relevant backport immediately, review logs, and check for unexpected PHP files or suspicious requests using double-encoded traversal patterns.
Ionut Arghire
2026.09.24
98% relevant
This article is a direct update on the same underlying event, adding that exploitation began within hours of disclosure, that attacks progressed from reconnaissance to active compromises, and that Patchstack observed a three-stage chain checking for pearcmd.php to achieve code execution.
info@thehackernews.com (The Hacker News)
2026.09.24
98% relevant
This article covers the same underlying event: attackers exploiting WordPress CVE-2026-87902 soon after disclosure. It appears to add reporting detail and confirmation of exploitation timing rather than describing a separate incident.
Bill Toulas
2026.09.23
100% relevant
This article appears to establish the exploitation phase of CVE-2026-87902, adding concrete evidence that attackers moved from probing to writing files and attempting command execution on vulnerable WordPress sites.
← Back to all stories