Newsbite analysis · Security
BleepingComputer
Hackers start exploiting critical WordPress flaw for code execution
Following the release of WordPress version 7.1.2, hackers have escalated their attacks exploiting vulnerability CVE-2026-87902. This unauthenticated path traversal bug allows remote code execution under specific conditions, granting attackers control over infected WordPress sites. Initial reconnaissance has turned into active exploitation, with malicious traffic increasing tenfold. Administrators are urged to patch their installations quickly.
Act nowConfidence: HighImmediate horizonStory: First reportCybersecurity risk: High
EvidenceOn record sourcesCompany only
Published 23 Sept 2026, 18:50 UTC3 min read
Lead image — BleepingComputer
Brief
NewsBite reading:Critical WordPress vulnerability exploited by hackers for remote code execution
TL;DR
- CVE-2026-87902 allows unauthenticated remote code execution.
- Attackers began exploiting the flaw less than five hours post-patch release.
- Initial reconnaissance transitioned to active malicious payload delivery.
- Exploitation enables shell command execution via files written to disk.
- WordPress patched the critical flaw across multiple versions.
Interesting facts
- The flaw has a critical severity rating of 9.2 out of 10.
- Exploited files are named like wp-pear-rce-flag.php and poc87902.php.
- Attackers used double-encoded traversal sequences to probe weaknesses.
What changed
Malicious exploitation of a critical vulnerability in WordPress has moved from probing to active attack phases.
Unchanged: Pre-4.6 WordPress versions will not receive a fix for this vulnerability.
What we still don't know
- Details on how many sites have been compromised.
- Specific examples of payloads used in attacks.
Decision signal
Decision brief
Actionable takeaways
- Update WordPress to version 7.1.2 immediately.
- Review server logs for any signs of malicious activity.
- Monitor for known attack IPs to prevent further exploitation.
- Ensure all plugins and themes in use are also patched.
Decision signal
Act now
Action required
Patch or update
Event status
Announced
Technical significance
Meaningful
Competitive impact
Threatens incumbents
Source reliability
High
Impact certainty
High
Novelty
High
Execution risk
Medium
Strategic weight
High
Trend: Accelerating
- Increasing frequency of cyber attacks on popular CMS platforms.
Sentiment signal
Sentiment
Overall: NegativeMood: Bearish
The news presents a bearish sentiment, indicating heightened risk factors for WordPress site administrators and developers.
Drivers
Rapidly escalating attacks following vulnerability disclosure.High exploitation potential of the reported flaw.
By category
securityNegative
Increased risk of exploitation due to a critical security vulnerability affects the overall trust in the platform.
Notable entities
WordPressproductNegative
The platform is facing security challenges due to critical vulnerabilities being exploited.
PatchstackcompanyPositive
They have proactively monitored and reported on the vulnerabilities affecting their user sites.
Market signal
Impact & reach
Hackers began exploiting CVE-2026-87902 aggressively soon after the vulnerability disclosure.
The urgency to patch is critical due to rapid exploitation of this serious vulnerability that could lead to wide-scale attacks on unsuspecting site administrators and users.
developersNegative
Developers using vulnerable WordPress sites face heightened risk of exploitation.
Geographic focus
GlobalNegative
Critical vulnerability affects a significant user base globally.
Likely losers
Website administrators with outdated versions of WordPress
Risk signal
Risk radar
Cybersecurity riskHigh
Rapidly escalating attacks exploiting a critical vulnerability.
Data governance riskMedium
Compromise of data due to vulnerabilities could attract scrutiny.
Reputational riskMedium
Reputational damages to WordPress and its ecosystem if exploitation spreads.
Execution riskMedium
Potential risks due to ineffective response to the threat.
Infrastructure riskMedium
Exploitation of vulnerabilities could lead to infrastructure compromises.
Geopolitical riskLow
No significant geopolitical implications identified.
Regulatory riskMedium
Potential regulatory scrutiny if widespread exploitation occurs.
Supply chain riskLow
Limited impact on the supply chain.
Talent displacement riskLow
No implications on workforce disruption.
AI liability riskLow
No direct implications involving AI.
Sourcing
Sources & evidence
Documents
WordPressPress release or statement
“WordPress addressed CVE-2026-87902 yesterday with the release of version 7.1.2”