Hackers Exploit Critical WordPress Flaw to Execute PHP Code on Vulnerable Sites

Threat actors have escalated exploitation of a critical WordPress vulnerability, moving from reconnaissance activity to attempts to write attacker-controlled PHP files onto vulnerable servers. The flaw, tracked as CVE-2026-87902, affects WordPress versions 4.7.0 through 7.1.1 and can lead to remote code execution under specific theme and PHP configurations . WordPress fixed the issue in version 7.1.2 and released backported patches for supported branches down to 4.7.37.…