Attackers exploit critical WordPress flaw to plant command-executing files

Attackers are exploiting a critical WordPress flaw to write files that can execute shell commands when accessed, BleepingComputer reports, citing security firm Patchstack. The activity has advanced from probing vulnerable sites to attempts to deliver payloads, with related traffic increasing tenfold. The flaw, CVE-2026-87902, can let an unauthenticated attacker make WordPress load a readable PHP file outside the active theme directory. Remote code execution requires particular theme and server conditions. WordPress patched the issue in version 7.1.2 and backported fixes through version 4.7; releases before 4.6 will not receive a fix.