WordPress flaw exploitation reported to move to file-writing payloads

Attacks move from probing to writing files

BleepingComputer reported that threat actors targeting CVE-2026-87902, an unauthenticated path-traversal flaw in WordPress that can enable remote code execution under certain conditions, moved from probing sites to delivering payloads. Patchstack reportedly observed payloads that write files to disk, including files containing a short tag that executes a shell command when accessed.

The initial activity described in the report was reconnaissance: attempts to identify WordPress sites vulnerable to CVE-2026-87902.

The reported activity has shifted from probing to payload delivery, including attempts to write files that can execute shell commands when accessed.

The reported shift matters because it marks a move from identifying potentially vulnerable sites to attempts that could enable command execution. WordPress released version 7.1.2 to address the flaw, with fixes also backported to branches down to 4.7.