Hackers Exploit Critical WordPress Flaw Just Hours After Patch Release
If you, your business, or someone you know rely on the use of WordPress in any way, applying patches immediately is essential to prevent possible compromise by a Remote Code Execution (RCE) attack. To be specific, security company Patchstack discovered widespread attacks using the CVE-2026-87902 vulnerability, which is an unauthenticated local file inclusion in WordPress' page template resolution.
When the attack was initially discovered, this local file inclusion flaw was just used for probing and didn't seem to correspond to a serious attack despite the major vulnerability used. But within hours of WordPress releasing the patch on September 22nd, sites affected by the vulnerability began receiving waves of attacks, including attempts at RCE.
This corresponds to the true danger of the exploit, though RCE is only possible in certain pre-existing system conditions are met. Without the prerequisites in place, escalation of CVE-2026-87902 beyond PHP file injection is very unlikely. That...
Copyright of this story solely belongs to hothardware.com. To see the full text click HERE
