CyberNew CyberNew
Vulnerabilities & CVEs BleepingComputer 3 weeks ago

Hackers start exploiting critical WordPress flaw for code execution

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Vulnerabilities & CVEs

Analyst Takeaway

"Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. Initial attack traffic was only for reconnaissance and started less than five hours after the patch was released in WordPress 7.1.2. Malicious activity increased by ten times, and attackers are now trying to deliver payloads...."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

Initial attack traffic was only for reconnaissance and started less than five hours after the patch was released in WordPress 7.1.2. Malicious activity increased by ten times, and attackers are now trying to deliver payloads.

WordPress security firm Patchstack reports that it observed the first malicious requests at 17:44 UTC on September 22 from a small group of IP addresses targeting multiple sites under its protection.

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →