Hackers start exploiting critical WordPress flaw for code execution

Reported by BleepingComputer (Bill Toulas)

Summary by Cyber Security News23 Sep 2026, 20:31 CEST

About this summary. This is a short, independently written summary of an article first published by BleepingComputer. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/

Hackers start exploiting critical WordPress flaw for code execution — Image: BleepingComputer

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

Read the full article at BleepingComputer →

CVE-2026-87902

Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

WordPress security advisory (AV26-952)

NCSC-2026-0389 [1.00] [M/H] Kwetsbaarheid verholpen in WordPress

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

CVE-2026-87902: how close is your WordPress to remote code execution?

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)