Hackers start exploiting critical WordPress flaw for code execution

A critical unauthenticated path traversal vulnerability (CVE-2026-87902) in WordPress, scoring 9.2 on the CVSS scale, is being actively exploited to achieve remote code execution without any authentication required. Attackers initially used the flaw for reconnaissance before escalating to dropping malicious files capable of executing arbitrary shell commands, dramatically raising the risk to affected sites. Any WordPress installation running a version prior to 7.1.2 remains exposed, making delayed patching an unacceptable risk. This incident underscores how quickly threat actors move from vulnerability discovery to weaponized exploitation, often within days of public disclosure, leaving unpatched systems with a dangerously narrow window for remediation.