Critical WordPress RCE Vulnerability Actively Exploited: Why You Must Update to 7.1.2 Immediately

The global cybersecurity landscape is on high alert as Hackers start exploiting critical WordPress flaw for code execution across thousands of servers.

Less than five hours after the official patch release, threat actors rapidly transitioned from probing vulnerable sites to actively deploying malicious payloads.

This rapid escalation underscores the severe danger posed by the newly disclosed CVE-2026-87902 vulnerability, which carries a critical severity score of 9.2 out of 10.

Website administrators must take immediate, decisive action to secure their digital infrastructure before these automated attacks compromise their data.

How Hackers start exploiting critical WordPress flaw for code execution

Security researcher Robert Ressl initially discovered this alarming issue during routine security audits.

It is fundamentally categorized as an Unauthenticated path traversal bug, meaning attackers do not even need an account on the target site to trigger the exploit.

Under specific server configurations, this bug allows an attacker to achieve a devastating Remote Code Execution (RCE) attack.

Initial attack traffic was purely for reconnaissance, designed to identify targets running outdated software versions by attempting to include ordinary core files.

However, the malicious activity quickly increased by ten times within a single day.

This alarming spike proves that Hackers start exploiting critical WordPress flaw for code execution aggressively rather than just mapping vulnerable networks.

According to security experts, the attackers require the active parent or child theme to have a top-level directory starting with specific naming conventions like “page-templates”.

“An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories.”

The Payload: Hackers start exploiting critical WordPress flaw for code execution

WordPress security firm Patchstack reported the first wave of malicious requests originating from a small group of highly active IP addresses.

During these attacks, the threat actors began dropping Patchstack malicious payloads directly onto the host servers to establish persistence.

The advanced third stage of this attack swaps the “config-show” command for “config-create,” allowing attackers to write a file wherever instructed.

The grim reality that Hackers start exploiting critical WordPress flaw for code execution means they can now write short tags that execute shell commands on access.

These generated files are typically delivered to the /tmp and /var/tmp directories on the host machine.

Administrators must realize that once Hackers start exploiting critical WordPress flaw for code execution, they gain the ability to completely hijack the web server.

“Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.”

Stopping the Threat Before Hackers start exploiting critical WordPress flaw for code execution

The only definitive way to protect your website is by applying the WordPress 7.1.2 security patch immediately.

This critical patch explicitly addresses the logic flaw within the page-template resolution process that enables the path traversal.

Fortunately, these vital fixes have also been backported to all branches down to version 4.7 to protect legacy installations.

In addition to updating the core software, security teams must proactively block the known malicious IP addresses at the firewall level.

For the latest security advisories and official software releases, you should always consult the official WordPress news blog.

Reviewing your server logs for double-encoded traversal sequences in the ‘pagename’ parameter is crucial to verify if Hackers start exploiting critical WordPress flaw for code execution on your system.

Frequently Asked Questions

Disclaimer: This article is for informational purposes only. Security threats evolve rapidly, and website administrators should always consult with certified cybersecurity professionals and official vendor documentation when securing their infrastructure.