WordPress flaw attacks reportedly shift from probing to code-execution attempts

From reconnaissance to file-writing attempts

BleepingComputer reported that Patchstack observed activity targeting CVE-2026-87902 rise tenfold after initial reconnaissance.

According to the report, attackers began attempting to write files to disk, including files containing a short tag that runs a shell command when the file is accessed. The vulnerability is an unauthenticated path-traversal flaw that can lead to remote code execution—running commands on a server from afar—only when specified conditions are present.

The reported activity initially consisted of reconnaissance probes intended to identify WordPress sites vulnerable to CVE-2026-87902.

The reported activity has shifted from probing to attempts to write files that can run shell commands when accessed.

Code execution depends on specified conditions

The reported transition from identifying vulnerable sites to delivering file-writing payloads would mark a more direct attempt to use the critical WordPress flaw. WordPress 7.1.2 and backported fixes were released for affected supported branches, according to the report.