# Hackers start exploiting critical WordPress flaw for code execution

> **Open Intelligence Dossier** · First detected: 2026-09-24 07:40 UTC · Category: Technology

## Executive Summary
Hackers are actively exploiting a critical vulnerability in WordPress core, prompting urgent security patches.

## Intelligence Brief
Recent coverage details an active wave of cyberattacks targeting a critical security flaw affecting WordPress core, which allows attackers to achieve remote code execution on vulnerable servers. According to reports from BleepingComputer and The Hacker News, hackers began exploiting the issue within hours of its public disclosure. Additional reporting from Security Affairs, heise online, SecurityWeek, and Forkast.news identifies the vulnerability specifically as CVE-2026-87902. TechRadar and Help Net Security further characterize the issue as an unauthenticated path traversal vulnerability, also referred to in coverage as the Click2Shell vulnerability. Publications such as Help Net Security and TechRadar emphasize that WordPress promptly issued security updates, specifically releasing version 7.1.2 to resolve the critical flaw.


The rapid rollout is detailed across multiple outlets including SecurityWeek and heise online, which note that patches were made available within hours. However, reports from Forkast.news and The Hacker News stress that attackers had already infiltrated environments before administrators could apply the fixes. Coverage does not yet specify the total number of compromised websites or identify the specific threat actor groups responsible for the ongoing exploitation campaign. The context surrounding this emerging cybersecurity event centers on the widespread use of the WordPress platform and the inherent risks posed by unauthenticated remote code execution vulnerabilities. Outlets like Security Affairs and TechRadar highlight how quickly malicious actors can weaponize newly disclosed software flaws before routine maintenance cycles can take effect.


The severity of CVE-2026-87902 stems from its ability to bypass authentication mechanisms, allowing remote attackers to execute arbitrary code on underlying servers running vulnerable software configurations, as outlined by reporting from The Hacker News and Help Net Security. As the situation develops, readers are advised by coverage from TechRadar and BleepingComputer to remain on guard and update their systems immediately. Future updates will likely clarify the full scale of the intrusions and determine whether additional security advisories or software patches are required. Coverage does not yet specify any further remediation steps beyond the deployment of the WordPress 7.1.2 update. Analysts and security researchers will continue monitoring the velocity of exploitation attempts against servers that have yet to apply the official vendor patch.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| forkast.news | WordPress Core Patched in Hours. Attackers Were Already Inside. | [Source Link](https://news.google.com/rss/articles/CBMiiwFBVV95cUxQN0EtYTFrODhFcEowSFcwWUZCWl9JbXBsNktfd0ZFcUcwU2xrbjNMLXF1aGtlR2s3bkd3bXRzQlU1b3BDN3UyaG5TekM4MTFaS2xZXzY5UDZmV2JWek5rWU5lbTVtQktTaUlEYXFVMWl5blR0cmR4WlBZekpiSEJ4YnRMaFptQnBKM0pj?oc=5) |
| Security Affairs | CVE-2026-87902: how close is your WordPress to remote code execution? | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxQeFA5Q2dFcklDSnREZWltWmg1aGxYd1JJMUlRY3JWb21RRmVaT1NGNHdRN3pick5UMUNmRFR5ZG5FY1kwN2VpQ3FHQWhCT1ZROVVjME9YTXpwVHZTNXJEWWU3aUVScDM5SFgyNlVxTndTMml5TWctbkVGXzkyTFc2QmdidWpBcktucGtlQ2VNdWllWEQ2T1RHV3RrMExPU0p2TEJMbHhxTDZOMVQtSElIQ0FOLUJRZ9IBuwFBVV95cUxOUE1qc09SS19WYXY3TFpsTDlYcDV5UXB0OEtqa2RSZzVrNXZwTFE1MHZqXzEzdXNiOEVvcThTQ1ZtNElEZUJHNzhtWk5LRFVWX2pfdTRrMUJPREp2UVROQ01ZamlNdVAyWjgteE1BelF3SHFlQjNIQ1h0SXEwZ1dZT01Jckk1cTZ4UEh6enFsZmRHZmdZQkJCeDc2XzJ) |
| heise online | Security updates: Click2Shell vulnerability to compromise WordPress websites | [Source Link](https://news.google.com/rss/articles/CBMiugFBVV95cUxQdnhJczZnMTdsVUNNYmlESzdnMEpiellGYjZjZDZpVl9hSXY0ZGd4U3B2b2lNZzFkVWlOVVRZY0xGSDdqbHNrcXE5UHRDZUtHWE5zRXlFUVpsSzNZaVdrZmFVNTZ4TGZJeXN4eHYzMmlRS05iUU1SOU5OM281NlRlODMwazhSeGVHWU5ubUQxR05VTHV1aVdocnFDZEVLM1d2OFVJUWtMVjh3dklaVnhZdXR1Qk53YmxEbUE?oc=5) |
| SecurityWeek | WordPress Patches ‘Click2Shell’ Vulnerability | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE95bEY3aXdIdElqSGtrMmh1Sk13ck5nLV83dUVUQ0N4X0JJUW0wWXVmclNxcGVTb3NLd2xPbW4tQ2Z0X1JhMk13d2EzV0VmY0hmMGRCcnlkVmpTd2ZyVjk4N2U4YkNLZ21DOWktYUJaVnNMWUptQ1VDY3lRT2MwUdIBgwFBVV95cUxNVmxwcVM0MjYxaHd6R1NHdmpXSTgtVXBrRDNWdjh1MmdzX3JEdGVmbGtDUzBwSlVHQkJHb3ZHRVpvMXpNWGxiQWozWkltM0lFSk5ta2JzaTdMc0V6UVZUNEtlRW5WRU1HVnp4bWhodS1RVWt3dm5tOWhjRnpodEtIbDlCVQ?oc=5) |
| The Hacker News | WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTFBxOGJITVYxa00yUV9iYzZLOVh4cEZ5bkZyblJ1U3JTRWxTekR0ZkVOWno3cG1semlra1VoYWl6c0pOUjZmbWdxckpEWGd0bnNMUWJzTzNUZlNjNTFWUWg2R29nRUtoZ3FDRUpsNTlMWnJuOEtPems2SDdvbUQtSmM?oc=5) |
| BleepingComputer | Hackers start exploiting critical WordPress flaw for code execution | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxPOXR2dWR2UUtnZVR0ZWJiSEVaUjJJMk05OG4wNUFpQ2FzVDk4ZnlUOEFfUkxiOXlHb0J4SXNZbGxQSWF0MmlvUDlJbnRjQjlDTnluMFlEWUNNMWRwRHh3THBvMFluWFo1Q0pOQ25ONWtJTUFIV3RxX1NuOGdubURJcGEtcDNDVTEyalNObkhMUFZDTGptMjg1VkhTNTRlSEc0X1FJVUVIQ0VHVVgySGNSVzdEaW9HQdIBuwFBVV95cUxQYm9fRXMyUUQ3WUZ2NlJjdlhwOGE5QmZoaFY2Ym5ZZWlPdG9OejF0SVhVZmxnZ3RmYnZRLWxYaTk5V2tGeFhZUHRpZGVTUW9OUTJwR2ZTTnhEUWpERERNN1l5cXoxS09IZzdia3gxNWx6Y0FNZXlZaDRSdnFvM19uV2xRWDZYaUowa0I4eWJjQ1BCUWZmb1JFX3IyTDF) |
| TechRadar | Hackers are targeting a critical WordPress flaw, so be on your guard | [Source Link](https://news.google.com/rss/articles/CBMiqgFBVV95cUxQUjM4c1VkczFIZGFjS3hNdU82ZXhyWjJoWFJ5V3VvT0w4OGM0RTFnZ2NBQjdFSVN3TDhfQzZhSndQem9YbGNyNFVIV1RxRF84RmhHdm5BbE5XWTYwclFpSjJsV0NYaF9mVllmdFhxQkY5c0Z6c2Flby1MMnhVVDB5ZFhfZXpYaUhFVlNYMHY4NmVyMG50ZFJhRGNjWUhocWM0b2pnSUFpekp3dw?oc=5) |
| Help Net Security | WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) | [Source Link](https://news.google.com/rss/articles/CBMilgFBVV95cUxNLXNPUjFxUFY2RkRqZ3c5Tmk4XzU2TllEQ1R6UTRGaHNGaWVGTmpRUTRpZ1FkWGZDSHVJaXdYQVRaMnQ2V2NRdWRDNmRqZi1Memk3c196N2VTVlhsMTZBeVBySG9tc2lNTTlPNllyLXQ0NTZUT0hvckgzN2tqLV9iRUgycGZnS2tuRzJWLWtqT3Qxb1h6V3c?oc=5) |
| The Hacker News | Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxQWlZqdDJMbGltTkJQNU9KZFgwRDdEa0sxZGZDNmdDdWduYk56bXJLcVJPRV9GRnVTOGNldHlaWHRYSFBDaTUtcDhQSWd2UmtwOTFUdjkzdDdxTVMzRFB0T3p3dW43Unh1UFJrWThaa0dlTXBJM2ZnZm1UemZIUDNOUA?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-09-24/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution*