Critical WordPress Vulnerability Exploited Immediately After Disclosure

A critical path traversal vulnerability in WordPress has been actively exploited in the wild, with attackers moving against unpatched sites almost immediately after the flaw became public knowledge. The vulnerability, tracked as CVE-2026-87902, allows remote and unauthenticated attackers to execute arbitrary code on affected installations, placing it among the more severe classes of web application flaws.

This piece covers what is known about CVE-2026-87902, who faces the greatest risk, and what site owners and developers should do right now. It is aimed at WordPress administrators, plugin and theme developers, and security teams responsible for maintaining web infrastructure at any scale.

What broke in Critical WordPress Vulnerability Exploited

The vulnerability is a path traversal flaw, a class of bug that lets an attacker navigate outside the intended directory structure of a web application and access or manipulate files they should never reach. In this case, the flaw is severe enough to enable remote code execution without requiring any authentication — meaning an attacker does not need a username, password, or any existing foothold on a target system to trigger it. The combination of unauthenticated access and code execution capability pushes CVE-2026-87902 into the highest-risk tier for WordPress sites.

Exploitation began almost immediately after the vulnerability was publicly disclosed, a pattern that has become increasingly common as adversaries monitor security advisories and CVE feeds in near real time. The speed of weaponization leaves little margin for site owners to respond once a flaw goes public, underscoring why patch cadence and alerting matter so much in WordPress environments.

Who is exposed by Critical WordPress Vulnerability Exploited

Any WordPress installation affected by the vulnerable component and accessible over the internet is potentially at risk, with unauthenticated exploitation meaning that even sites with no registered users or tightly controlled login pages are exposed. Shared hosting environments that run many WordPress sites on the same infrastructure are particularly sensitive, because a successful attack against one tenant could potentially affect neighboring installations depending on server configuration.

Organizations that treat WordPress as a lower-priority asset — community sites, microsites, or legacy marketing pages that are infrequently updated — tend to be the most vulnerable in practice, because they accumulate unpatched versions over time. Developers and agencies managing WordPress fleets for multiple clients should treat this as an urgent audit trigger across all managed properties, not only their most prominent deployments.

What to do now about Critical WordPress Vulnerability Exploited

The most immediate action for any WordPress site operator is to identify whether their installation or any installed component is affected by CVE-2026-87902 and apply available patches without delay. Because exploitation was observed immediately after disclosure, there is no safe waiting period — sites that are already internet-facing should be treated as potentially targeted regardless of their size or perceived value to attackers.

In parallel, administrators should review web server and application logs for signs of path traversal attempts, looking for unusual sequences in request URLs that include directory traversal patterns. Web application firewall rules that block known traversal signatures can add a layer of defense while patching is underway, but they are not a substitute for applying the fix. Hosting providers and managed WordPress platforms may be pushing mitigations independently, so checking with your provider is a worthwhile step even if you are not managing the server directly.

How the Critical WordPress Vulnerability Exploited issue works

Path traversal attacks work by manipulating file path inputs that the application passes to underlying system calls. When input is not properly sanitized, an attacker can supply sequences such as ../ to climb up the directory tree and reference files outside the web root. In CVE-2026-87902, this mechanism is exposed to unauthenticated requests, meaning the attacker does not need to bypass any login layer before supplying malicious input to the vulnerable endpoint.

The code execution capability linked to this flaw amplifies the danger considerably beyond simple file disclosure. Rather than only reading sensitive files, an attacker who achieves remote code execution can install backdoors, exfiltrate database credentials, pivot to other systems on the same network, or enroll the server in a botnet. Because WordPress powers a substantial share of the public web, vulnerabilities with this profile attract automated scanning and exploitation tooling quickly after disclosure.

What is still unknown about Critical WordPress Vulnerability Exploited

The specific component within WordPress that carries CVE-2026-87902 — whether it is WordPress core itself, a widely used plugin, or a theme — has not been identified in the available summary, and that distinction matters significantly for scoping the affected population. Without knowing precisely which component is vulnerable, site operators cannot easily determine whether they are affected without a broader audit.

The scale of active exploitation also remains unclear. It is not yet known how many sites have been successfully compromised, what threat actors or groups are behind the exploitation activity, or whether proof-of-concept code has been widely shared in underground forums. Security teams monitoring CVE-2026-87902 should watch for updated advisories that narrow down the affected component and provide indicators of compromise, as that information will sharpen both the detection and remediation picture considerably.