WordPress CVE-2026-87902 Under Active Exploitation by Unauthenticated Attackers

Key points

• CVE-2026-87902 is a path traversal bug in WordPress.
• Unauthenticated attackers can achieve remote code execution.
• Exploitation began after public disclosure.
• Remote compromise is possible without valid credentials.
• Patch and mitigate immediately.

A newly disclosed security defect in WordPress, identified as CVE-2026-87902, is a path traversal issue that permits unauthenticated actors to run arbitrary code on vulnerable installations. The flaw was made public, and almost immediately, attackers began leveraging it in real-world campaigns.

Because no login is required, the exposure is broad. Any WordPress site that has not applied the vendor's fix or a compensating control could be targeted. This includes K-12 districts, government portals, and other organizations running the content management system.

Successful exploitation leads to full remote compromise. An attacker can execute commands, move laterally, or install persistent backdoors. The path traversal component lets them reach files outside intended directories, which is often a precursor to remote code execution.

The timing is notable. Exploitation in the wild following public disclosure is a common pattern, but the unauthenticated nature raises urgency. WordPress powers a large share of the web, so the blast radius is significant.

What to watch: vendor advisories, WAF signatures, and signs of unusual file access or new admin users. Monitor logs for traversal patterns and unexpected outbound connections. Prioritize patching internet-facing instances.

What to do now

1. Apply the latest WordPress security update that addresses CVE-2026-87902 immediately.
2. If patching is delayed, deploy virtual patching via WAF to block path traversal attempts.
3. Audit web server logs for encoded traversal sequences and unexpected POST requests.
4. Restrict file permissions and disable unnecessary file editing features.
5. Rotate credentials and API keys for any potentially exposed instance.
6. Scan for webshells and unauthorized admin accounts.
7. Isolate or take offline any confirmed compromised host.

CVE references

• CVE-2026-87902

Original source

SecurityWeek