WordPress Core Flaw Enables Remote Code Execution, Exploited Within Hours of Public Disclosure

A critical path‑traversal vulnerability identified as CVE-2026-87902 has been weaponized by attackers almost immediately after it was made public, allowing unauthenticated actors to run arbitrary code on vulnerable WordPress installations.

The flaw, which resides in the core file‑handling routine of WordPress, permits a remote user to manipulate file paths and inject malicious payloads without needing any credentials. SecurityWeek was the first outlet to publish details of the issue, and its report notes that exploitation attempts were observed in the wild within minutes of the advisory.

WordPress powers roughly 43% of all websites, making any widespread vulnerability a significant concern for both small bloggers and large enterprises. The platform’s open‑source nature means that updates are distributed quickly, but the sheer number of sites that run outdated versions or rely on third‑party plugins can delay remediation. Security experts warn that even sites that have applied the latest core update may remain at risk if vulnerable plugins or themes reuse the same file‑handling logic.

In response to the discovery, the WordPress security team released a patch the same day, addressing the path‑traversal logic and tightening validation checks. Administrators are urged to apply the update without delay, clear any cached files, and audit their installations for signs of compromise. Additionally, best‑practice recommendations include disabling file editing from the dashboard, employing a web‑application firewall, and limiting write permissions on the server.

Industry analysts view the rapid exploitation as a reminder of the “window of exposure” that follows public disclosure of zero‑day flaws. While responsible disclosure aims to give developers time to issue fixes, the internet’s threat landscape often shortens that window dramatically. Organizations that maintain a robust patch‑management process and monitor for anomalous activity are better positioned to mitigate such fast‑moving threats.

Looking ahead, the WordPress project has pledged to accelerate its security response cycle and improve automated testing for similar file‑system functions. Meanwhile, security researchers continue to monitor for related exploit kits and will likely publish further guidance as more data emerges. Site owners who have not yet updated are advised to treat the vulnerability as a high‑severity issue and prioritize remediation to avoid potential data breaches or site defacement.