← Back to Feed

WordPress Remote Code Execution Vulnerability

CVE-2026-87902

September 24, 2026 · HKCERT · Severity: HIGH

This article reports a remote code execution vulnerability in WordPress, CVE-2026-87902, which affects versions from 4.7.0 to 7.1.1. A proof-of-concept exploit has been published, and the vendor has released version 7.1.2 as a fix. 📌 **Analyst Note:** The publication of a proof-of-concept exploit significantly increases the risk of widespread attacks, especially against unpatched WordPress sites. Organizations should prioritize updating to version 7.1.2 and consider implementing web application firewalls as a temporary mitigation.

Key Takeaways

  • A remote code execution vulnerability identified in WordPress, tracked as CVE-2026-87902, affects a wide range of versions from 4.7.0 through 7.1.1, and a proof-of-concept exploit has been published.
  • The vulnerability allows a remote attacker to execute arbitrary code on the targeted system, impacting millions of websites running affected WordPress versions.
  • WordPress has released version 7.1.2 to address this vulnerability, and administrators are strongly advised to update their installations immediately to prevent exploitation.
☕ Buy a Coffee