Угроза выполнения произвольного кода на WordPress

A critical flaw tracked as CVE-2026-87902 has been found in the WordPress core, and attackers began exploiting it mere hours after the fix shipped. WordPress patched the issue on September 22 with version 7.1.2, but the first exploitation attempts were already observed shortly afterward, according to The Hacker News. The bug lets an unauthenticated attacker craft a request that forces WordPress to load an arbitrary PHP file instead of restricting inclusion to the active theme's folder — this requires the malicious file to already be present on the server, but that's not a major hurdle for a determined attacker. Depending on server configuration, this file-inclusion flaw can escalate to full remote code execution, so every site running WordPress versions from 4.7.0 through 7.1.1 should be updated to 7.1.2 or later without delay.