Critical WordPress Vulnerability Uncovered: Immediate Action Required
A significant security flaw has been identified within the widely used WordPress content management system, enabling nefarious actors to execute arbitrary code on the server hosting websites.
This vulnerability, logged as CVE-2026-87902, underscores the urgency for affected users to act. Fortunately, on September 22, WordPress took proactive measures by releasing a patch.
However, it is alarming to note that the initial exploitation attempts of this vulnerability were observed merely hours after release.
Consequently, all organizations that utilize WordPress for their corporate sites or blogs are implored to implement this update without delay.
Vulnerable WordPress Versions Linked to CVE-2026-87902
As indicated by data shared by WordPress on GitHub, every version of the CMS ranging from 4.7.0 to 7.1.1 is susceptible.
The company has rolled out updates across all supported branches of the platform; a detailed table enumerating the patched versions is accessible on the official GitHub page. Users are urged to ensure their systems are updated to version 7.1.2 or higher.
Understanding the CVE-2026-87902 Vulnerability: Risks and Implications
Traditionally, WordPress restricts the loading of PHP template files to a designated folder within the active theme.
However, the emergence of the CVE-2026-87902 vulnerability has altered this dynamic, permitting an attacker to construct a request that allows inclusion of arbitrary PHP files—circumventing any authorization requirements.
While the PHP file must be pre-existing on the targeted server, this poses minimal challenge for a determined intruder.
This situation resembles a path traversal vulnerability, yet many sources categorize CVE-2026-87902 as a Remote Code Execution (RCE) vulnerability.
In particular configurations of WordPress and PHP servers, the exploitation can facilitate the execution of arbitrary code, representing a substantial threat.
Recommended Precautions for Protection
The paramount strategy for safeguarding a corporate WordPress site is to adopt the latest version of the software.
The researcher who uncovered this vulnerability provides additional strategies for enhancing CMS security; however, it is vital to recognize that such measures should serve as a supplement to, not a substitute for, the critical patch.
Moreover, The Hacker News outlines specific PHP filenames and IP addresses linked to the attacks leveraging CVE-2026-87902, offering potential indicators that a WordPress installation may have been compromised.
The narrow window between the announcement of a vulnerability and the onset of exploit attempts necessitates that businesses maintain a robustly configured, centralized vulnerability management framework.
To this end, organizations should deploy specialized solutions that can effectively identify and address vulnerabilities, prioritize them according to genuine risk levels, and automate remediation processes.
Source link: Kaspersky.com.
