A critical security flaw in WordPress has emerged as an immediate threat to websites worldwide. The vulnerability, identified as CVE-2026-87902, allows attackers to execute arbitrary code on web servers running the popular content management system. WordPress released a security patch on September 22, however, exploitation attempts began within hours of the update’s release.

Organizations operating WordPress-based websites or blogs face an urgent security imperative. Therefore, security experts strongly recommend immediate updating to protect against this actively exploited vulnerability.

Which WordPress Versions Are Affected

According to information published on WordPress’s GitHub repository, the vulnerability impacts a wide range of versions. Specifically, all WordPress installations from version 4.7.0 through 7.1.1 contain this security flaw. This extensive version range means millions of websites potentially face exposure to attack.

WordPress has responded by releasing security updates across all supported branches. Site administrators should upgrade to version 7.1.2 or newer for the latest WordPress installations. A comprehensive table of patched version numbers for all affected branches is available on the company’s official GitHub page.

Understanding the CVE-2026-87902 Security Flaw

The vulnerability exploits how WordPress handles PHP template file loading. Under normal operations, WordPress restricts PHP template loading to a designated folder within the active theme. However, CVE-2026-87902 breaks this security boundary in a dangerous way.

Attackers can craft malicious requests that force WordPress to include arbitrary PHP files from anywhere on the server. Moreover, this exploitation requires no authentication or authorization, making it particularly dangerous. While the malicious PHP file must already exist on the target server, attackers have multiple methods to accomplish this prerequisite step.

Why This Qualifies as Remote Code Execution

Security researchers classify CVE-2026-87902 primarily as an RCE (Remote Code Execution) vulnerability rather than a simple path traversal issue. The classification reflects the serious consequences of successful exploitation. Under certain WordPress and PHP server configurations, attackers can execute arbitrary code remotely on the vulnerable system.

This capability gives attackers extensive control over compromised websites. Additionally, successful exploitation can lead to data breaches, website defacement, or using the server as a launching point for additional attacks.

Immediate Protection Steps Required

Installing the latest WordPress version represents the only effective protection against this vulnerability. The researcher who discovered CVE-2026-87902 provides additional hardening recommendations for WordPress security. However, these supplementary measures cannot replace the essential security patch.

Organizations should treat this update as a critical priority. The window between patch release and active exploitation has narrowed to mere hours, leaving little room for delay.

Identifying Compromised WordPress Sites

The Hacker News has published specific indicators of compromise related to CVE-2026-87902 attacks. These indicators include particular PHP filenames and IP addresses observed in active exploitation attempts. Site administrators can use these markers to determine whether their WordPress installation has already been compromised.

Security teams should actively monitor for these indicators while simultaneously deploying the patch. Early detection of compromise allows for faster incident response and damage limitation.

The Broader Vulnerability Management Picture

The rapid exploitation of CVE-2026-87902 highlights a critical challenge in modern cybersecurity. Only hours separated the vulnerability disclosure from active attacks, demonstrating how quickly threat actors move. This compressed timeline makes manual vulnerability management increasingly impractical for organizations.

Companies need properly configured, centralized vulnerability management systems to address this reality. Specialized solutions can identify and resolve vulnerabilities across an organization’s entire digital infrastructure. Furthermore, these systems should prioritize vulnerabilities based on actual risk factors rather than treating all issues equally.

Automation plays an essential role in effective vulnerability management. Automated remediation processes can deploy critical security patches faster than manual intervention allows. In cases like CVE-2026-87902, where attackers exploit vulnerabilities within hours, this speed difference becomes crucial for maintaining security posture.

Key Takeaways for WordPress Site Owners

The CVE-2026-87902 vulnerability serves as a stark reminder of ongoing security challenges. WordPress powers a significant portion of the internet, making any vulnerability in the platform a high-value target for attackers. Site owners must maintain vigilance and implement prompt security updates as their primary defense.

Organizations should also consider this incident a catalyst for reviewing their broader security practices. Implementing centralized vulnerability management systems provides better protection against future threats. These investments in security infrastructure pay dividends by reducing response times and minimizing exposure windows.

Ultimately, the speed of exploitation in the CVE-2026-87902 case demonstrates that reactive security approaches no longer suffice. Organizations need proactive systems that can detect, prioritize, and remediate vulnerabilities before attackers can capitalize on them.

Original Source: www.kaspersky.com