Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. The vulnerability, tracked as CVE-2026-87902, is described as critical due to its potential for remote code execution without authentication. According to recent advisories, the flaw stems from insufficient input validation in a core WordPress component, allowing unauthenticated attackers to upload malicious files. Successful exploitation could allow an attacker to gain full control of the affected server, including the ability to install malware, exfiltrate data, or use the site as a pivot for further attacks. WordPress site administrators are urged to apply the latest security updates and monitor for suspicious file activity. The exploitation trend highlights the need for rapid patching and enhanced web application firewall rules to block known exploitation patterns.