Hackers start exploiting critical WordPress flaw for remote code execution

Threat actors have escalated from scanning to actively exploiting a critical vulnerability in WordPress, tracked as CVE-2026-87902. Attackers are leveraging the flaw to write executable files to the underlying disk, enabling remote shell command execution. Administrators should immediately audit their instances for compromise and apply available patches or security updates to prevent full server takeover.