CVE-2026-87902: Attackers Exploit WordPress for Code Execution

En bref

• CVE-2026-87902 is a high-severity WordPress flaw allowing file writes and shell command execution.
• Attackers are scanning for and exploiting unpatched WordPress installations.
• Successful exploitation can lead to full server compromise and data theft.
• Immediate patching, WAF rules, and log monitoring are critical for defense.

A high-severity security issue in WordPress, tracked as CVE-2026-87902, is being leveraged by malicious actors. These individuals are scanning for installations that remain unpatched and then attempting to upload files and run system-level commands. The flaw permits arbitrary file creation and command execution, which can lead to full server compromise.

Any organization running WordPress—including school districts and government agencies—is at risk if the site has not received the necessary updates. The attackers are not targeting a specific victim; they are opportunistically probing internet-facing sites. Because WordPress powers a large share of the web, the pool of potential targets is vast.

The impact is severe: successful exploitation allows an attacker to execute code, write files, and run shell commands. This could result in data theft, website defacement, or the site being used as a pivot into internal networks. For K-12 and government entities, this threatens sensitive student data and critical services.

The vulnerability is tracked as CVE-2026-87902 with a high severity rating. While details about the exact root cause are limited, the observed activity shows active exploitation. Administrators should assume that unpatched sites are already being probed and potentially compromised.

What to watch: Monitor for unexpected file changes, new administrative users, and outbound connections from web servers. Check logs for suspicious POST requests or command execution attempts. Apply vendor patches immediately once available; if not, consider virtual patching or taking affected sites offline.

À faire maintenant

1. Immediately update WordPress core, plugins, and themes to the latest versions.
2. Deploy a web application firewall (WAF) with rules blocking exploitation attempts for CVE-2026-87902.
3. Review server logs for signs of file writes, shell command execution, or unusual outbound traffic.
4. Restrict file system permissions so the web server cannot write to sensitive directories.
5. Run a full malware scan and integrity check on all WordPress installations.
6. Isolate or take offline any site that cannot be patched right away.
7. Enforce least privilege for database and system accounts used by WordPress.

Références CVE

• CVE-2026-87902

Source originale

BleepingComputer