Hackers start exploiting critical WordPress flaw for code execution

Recent coverage details an active wave of cyberattacks targeting a critical security flaw affecting WordPress core, which allows attackers to achieve remote code execution on vulnerable servers. According to reports from BleepingComputer and The Hacker News, hackers began exploiting the issue within hours of its public disclosure. Additional reporting from Security Affairs, heise online, SecurityWeek, and Forkast.news identifies the vulnerability specifically as CVE-2026-87902. TechRadar and Help Net Security further characterize the issue as an unauthenticated path traversal vulnerability, also referred to in coverage as the Click2Shell vulnerability. Publications such as Help Net Security and TechRadar emphasize that WordPress promptly issued security updates, specifically releasing version 7.1.2 to resolve the critical flaw.

The rapid rollout is detailed across multiple outlets including SecurityWeek and heise online, which note that patches were made available within hours. However, reports from Forkast.news and The Hacker News stress that attackers had already infiltrated environments before administrators could apply the fixes. Coverage does not yet specify the total number of compromised websites or identify the specific threat actor groups responsible for the ongoing exploitation campaign. The context surrounding this emerging cybersecurity event centers on the widespread use of the WordPress platform and the inherent risks posed by unauthenticated remote code execution vulnerabilities. Outlets like Security Affairs and TechRadar highlight how quickly malicious actors can weaponize newly disclosed software flaws before routine maintenance cycles can take effect.

The severity of CVE-2026-87902 stems from its ability to bypass authentication mechanisms, allowing remote attackers to execute arbitrary code on underlying servers running vulnerable software configurations, as outlined by reporting from The Hacker News and Help Net Security. As the situation develops, readers are advised by coverage from TechRadar and BleepingComputer to remain on guard and update their systems immediately. Future updates will likely clarify the full scale of the intrusions and determine whether additional security advisories or software patches are required. Coverage does not yet specify any further remediation steps beyond the deployment of the WordPress 7.1.2 update. Analysts and security researchers will continue monitoring the velocity of exploitation attempts against servers that have yet to apply the official vendor patch.