Hackers start exploiting critical WordPress flaw for code execution

Threat actors are actively exploiting a critical unauthenticated path traversal vulnerability in WordPress, tracked as CVE-2026-87902, to achieve remote code execution under specific conditions. The exploitation involves writing malicious PHP files to the server's filesystem, which execute shell commands when accessed. Initial activity began within hours of the patch release, with reconnaissance escalating to active payload delivery, including file writing to /tmp and /var/tmp directories using attacker-controlled content.

AI-extracted · verify before operational use