WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution

Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do.
RS Web Solutions

Severe WordPress Core Flaw Allows Attackers to Run Code Without Authentication

Critical WordPress core flaw discovered: attackers can run code without authentication, putting millions of sites at risk.
RS Web Solutions

Serious Vulnerability in WordPress Allows Unauthenticated Users to Run Remote Code

Unauthenticated users can run remote code, putting millions of websites at risk. Learn how to protect your site now.
Help Net Security

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress 7.1.2 security release fixes a critical flaw (CVE-2026-87902) letting unauthenticated attackers load local PHP files and run code.
The Hacker News

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable ...
The Hacker News

New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

WordPress 7.1.1 fixes Click2Shell, which can force theme installs from crafted links and was chained with a theme flaw for code execution.

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component ...