Hackers Exploit Critical WordPress Flaw Just Hours After Patch Release
When the attack was initially discovered, this local file inclusion flaw was just used for probing and didn't seem to correspond to a serious attack despite the major vulnerability used. But within hours of WordPress releasing the patch on September 22nd, sites affected by the vulnerability began receiving waves of attacks, including attempts at RCE.
This corresponds to the true danger of the exploit, though RCE is only possible in certain pre-existing system conditions are met. Without the prerequisites in place, escalation of CVE-2026-87902 beyond PHP file injection is very unlikely. That much is good news for website owners and server operators, but the risk of further escalation is real if the right conditions are present.
That's actually why the discovery of the attacks comes from security company Patchstack rather than the WordPress team itself. Patchstack's monitoring of its own clientele (including businesses using WordPress) revealed what attacks were being attempted even against protected sites. The initial vulnerability was discovered with the help of AI by Robert Ressl, but the bulk of useful documentation about the exploit has come from Patchstacks.
With that said, either updating to the latest 7.1.2 version of WordPress or the newest version supported by your existing branch is firmly recommended. So long as you can update your current WordPress installation (even on older branches as far back as version 4.8), you should be safe from this one. Having checked my own WordPress site while working on this one, I was pleased to discover that my free plugins had already done the job for me, no manual intervention required. That may not be the case for all WordPress users, though, especially enterprise users or those with highly customized themes.
