Hackers start exploiting critical WordPress flaw for code execution

Threat actors have escalated from probing WordPress sites vulnerable to CVE-2026-87902 to actively exploiting the flaw, writing files to disk that execute shell commands when accessed. This critical vulnerability allows remote code execution, putting thousands of sites at risk. Administrators are urged to patch immediately to prevent compromise and potential data breaches.