Hackers Actively Exploit New WordPress Flaw to Run Shell Commands

Security researchers have confirmed that malicious actors are now moving beyond simple scanning of vulnerable WordPress installations to actively exploiting a recently disclosed flaw, identified as CVE-2026-87902, to write files that trigger shell commands when accessed.

The vulnerability allows an attacker to place arbitrary files on a target server and then execute code by requesting those files. By leveraging this capability, threat actors can gain the same level of control as traditional remote‑code‑execution bugs, potentially installing backdoors, harvesting data, or using compromised sites to launch further attacks.

Initial reports indicated that the flaw was being used primarily for reconnaissance, with automated tools probing the internet for sites that had not yet applied the patch. Over the past few days, however, evidence of active exploitation has surfaced, showing that the same tools are now delivering payloads that write malicious scripts to the web root.

Given that WordPress powers a substantial portion of the web—estimates regularly place its market share around 40 %—the exposure is significant. Unpatched installations could become entry points for broader compromise, ranging from website defacement to the deployment of ransomware or the exfiltration of user credentials.

The WordPress security team released a patch for CVE-2026-87902 shortly after the vulnerability was made public, and core contributors have urged site owners to update immediately. Many hosting providers are also rolling out automatic updates or notifying customers of the risk. Users are advised to verify that their installations are running the latest version and to review file permissions that could be abused by the exploit.

Experts anticipate that attempts to leverage the flaw will continue to rise as attackers scan for lagging sites. Defensive measures such as web‑application firewalls, strict file‑upload controls, and regular integrity checks are recommended to detect and block malicious file writes. Keeping backups and monitoring server logs for unusual activity remain essential components of a robust response strategy.