Skip to content
WordPress Patch CVE-2026-87902 Exploited Within Hours of Release

WordPress Patch CVE-2026-87902 Exploited Within Hours of Release

First seen 14 Oct 2026, 20:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 21:33 UTC
  • •CVE-2026-87902 allows code execution on unpatched WordPress sites.
  • •Exploitation began within hours of the patch release on September 22, 2026.
  • •CISA added the CVE to its KEV catalog on September 25, indicating active exploitation.

On September 22, 2026, WordPress released version 7.1.2 to patch CVE-2026-87902, a vulnerability allowing attackers to execute code without authentication. However, malicious probing began just hours after the patch was disclosed, with automated attacks escalating within 24 hours. Cybersecurity firm Patchstack noted the first attack attempts at 11:49 UTC on the same day, and by 15:34 UTC, attackers were attempting to write files to servers. The flaw was backported to earlier versions, making many sites vulnerable if not updated promptly. The rapid exploitation highlights a significant gap between patch release and system updates, as attackers can weaponize disclosed vulnerabilities before organizations can secure their systems. The Cybersecurity and Infrastructure Security Agency (CISA) added this CVE to its Known Exploited Vulnerabilities catalog on September 25, 2026, indicating active exploitation. Organizations are advised to check for signs of compromise even after applying the patch.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-22
WordPress patch released for CVE-2026-87902
Version 7.1.2 was released to fix a critical vulnerability allowing unauthenticated code execution.
Spiceworks
2026-09-22
First attack attempts logged
Patchstack recorded the first probing activity at 11:49 UTC, escalating to file-writing attempts by 15:34 UTC.
Cybersecurity-Insiders
2026-09-25
CVE added to CISA KEV catalog
CISA confirmed active exploitation of CVE-2026-87902, highlighting its critical nature.
Spiceworks

More articles in this cluster (2)

Following this threat?

Track CVE-2026-87902 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

What versions of WordPress are affected?
Any version prior to 7.1.2 that did not receive the patch for CVE-2026-87902 is vulnerable.
How quickly should I act after patching?
Immediately check for signs of compromise, as attackers may have exploited the vulnerability before the patch was applied.
What should I do if my site was exposed?
Review logs, check for unauthorized files, and consider cleaning or rebuilding the site.