CVE Tools
Track your stack

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

The Hacker NewsBy The Hacker News

PatchWordPress

Our summary

WordPress has released fixes for CVE-2026-87902, a CVSS 9.2 core vulnerability affecting versions 4.7.0 through 7.1.1. An unauthenticated attacker could cause WordPress to load PHP files outside theme directories, which could lead to attacker-controlled code execution on certain server and theme configurations. Site owners should update to WordPress 7.1.2 or the applicable supported-branch release; no workaround is available.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. Help Net SecurityWeek in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documentsCVE-2026-87902
  2. Kaspersky Daily (RU)Угроза выполнения произвольного кода на WordPressCVE-2026-87902
  3. SecurityWeekCritical WordPress Vulnerability Exploited Immediately After DisclosureCVE-2026-87902
  4. The Hacker NewsAttackers Exploit WordPress CVE-2026-87902 Within Hours of DisclosureCVE-2026-87902
  5. BleepingComputerHackers start exploiting critical WordPress flaw for code executionCVE-2026-87902
  6. Help Net SecurityWordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)CVE-2026-87902
  7. PatchstackCVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the PatchCVE-2026-87902
  8. PatchstackWordPress 7.1.2 Security Release: Unauthenticated LFI to RCECVE-2026-87902

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store