WordPress Patches a Critical Severity Security Vulnerability

WordPress patches a critical severity security vulnerability

WordPress has patched what it described as a critical severity security vulnerability that would allow an unauthenticated attacker full remote code execution (RCE) capabilities. There have already been reports of attacks in the wild. Given its popularity, WordPress has frequently been under attack, and patched another maximum severity bug allowing RCE in July. WordPress said the current hole, tracked as CVE-2026-87902, was discovered and reporte…

Hackers are targeting a critical WordPress flaw, so be on your guard

Mitigations and a patch are already available but given the severity of the WordPress flaw, immediate patching is recommended.

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]

Update to WordPress 7.1.2 to fix a critical security flaw

WordPress has released an important update to address a serious security issue. The release of WordPress 7.1.2 fixes a critical unauthenticated path traversal vulnerability which is tracked as s CVE-2026-87902 and has a CVSS v4.0 score of 9.2 (Critical). Left unpatched, the flaw could allow an attacker to access a PHP file which could ultimately lead to complete site compromise. The description of the vulnerability is as follows: “An unauthentic…

Hackers Exploit Critical WordPress Flaw Just Hours After Patch Release

If you, your business, or someone you know rely on the use of WordPress in any way, applying patches immediately is essential to prevent possible compromise by a Remote Code Execution (RCE) attack. To be specific, security company Patchstack discovered widespread attacks using the CVE-2026-87902 vulnerability, which is an unauthenticated local

Critical WordPress RCE Bug Actively Exploited Within Hours

Threat actors are actively exploiting a critical WordPress vulnerability, CVE-2026-87902, just hours after its public disclosure. The unauthenticated remote code […]