importantSYS.SOURCE: The Hacker News• 2026-09-24T11:06:18+05:30

WordPress RCE Vulnerability CVE-2026-87902 Exploited Shortly After Disclosure

#wordpress #rce #vulnerability #web security

A critical remote code execution (RCE) vulnerability in WordPress (CVE-2026-87902, CVSS 9.2) is being actively exploited within hours of disclosure, requiring urgent patching. Attackers leverage specific theme configurations to include malicious PHP files and write payloads to server directories like /tmp.

Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.

The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).

"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file

Read original article

*** END OF TRANSMISSION ***

> AI SYSTEMS LACK INTENT AND MOTIVATION, ACCORDING TO ANALYSIS > META REMOVES CRITICAL VIDEO EXPOSING AI GLASSES DURING ON-SITE FILMING > OPENAI AI AGENT UNAUTHORIZED ACCESS TO AUSTRALIAN MEDICARE STATISTICS PORTAL > TEAMFILTRATION EXPLOITS DEFAULT PASSWORDS IN MICROSOFT 365 SERVICE ACCOUNTS > WORDPRESS RCE VULNERABILITY CVE-2026-87902 EXPLOITED SHORTLY AFTER DISCLOSURE > ROGUE AI AGENT ACTIVITY AND SECURITY BREACH ATTEMPTS ON URLQUERY.NET > CONTRASTIVE LANGUAGE MODELS > MODERNIZING OPEN-SOURCE DESKTOPS: UX INNOVATION BEYOND THE WIMP MODEL > OPENAI AI AGENT BREACHES AUSTRALIAN GOVERNMENT HEALTHCARE PORTAL, PM CONFIRMS > META UNVEILS NEW FEATURES FOR AI AGENT MUSE AT CONNECT 2026> AI SYSTEMS LACK INTENT AND MOTIVATION, ACCORDING TO ANALYSIS > META REMOVES CRITICAL VIDEO EXPOSING AI GLASSES DURING ON-SITE FILMING > OPENAI AI AGENT UNAUTHORIZED ACCESS TO AUSTRALIAN MEDICARE STATISTICS PORTAL > TEAMFILTRATION EXPLOITS DEFAULT PASSWORDS IN MICROSOFT 365 SERVICE ACCOUNTS > WORDPRESS RCE VULNERABILITY CVE-2026-87902 EXPLOITED SHORTLY AFTER DISCLOSURE > ROGUE AI AGENT ACTIVITY AND SECURITY BREACH ATTEMPTS ON URLQUERY.NET > CONTRASTIVE LANGUAGE MODELS > MODERNIZING OPEN-SOURCE DESKTOPS: UX INNOVATION BEYOND THE WIMP MODEL > OPENAI AI AGENT BREACHES AUSTRALIAN GOVERNMENT HEALTHCARE PORTAL, PM CONFIRMS > META UNVEILS NEW FEATURES FOR AI AGENT MUSE AT CONNECT 2026