Hackers start exploiting critical WordPress flaw for code execution

Threat actors have escalated from probing to actively exploiting CVE-2026-87902, a critical vulnerability in WordPress. The flaw allows attackers to write files to disk that execute shell commands when accessed, effectively enabling remote code execution. The exploitation represents a significant threat to WordPress site owners worldwide. Security researchers have observed a clear progression from reconnaissance activity to active exploitation. Site administrators are urged to patch immediately to prevent unauthorized code execution and potential full site compromise.