Hackers Just Turned a WordPress Bug Into a Full Takeover Tool

Michael Miller · 2026-09-23

Remember when a security flaw is just a theory? Yeah, that's not what's happening here. Threat actors have officially moved from poking at WordPress sites vulnerable to CVE-2026-87902 to actually exploiting it. And the result? They can write files to disk that execute shell commands the moment someone accesses them. If you run a WordPress site—or manage one for clients—this is the kind of news that should make you sit up straight. It's not just a vulnerability anymore. It's an active weapon. ### What Exactly Is CVE-2026-87902? Without drowning you in technical jargon, this flaw lets an attacker slip past normal defenses and drop malicious files onto your server. Those files aren't harmless. They wait for a trigger—usually a simple web request—and then run shell commands. That means full control over your server if you're not careful. Think of it like someone hiding a spare key under your doormat. Except this key doesn't just open the door. It also turns off your alarm, unlocks every room, and calls a moving truck. ### Why This Is Different From a Typical Bug Most WordPress vulnerabilities require specific conditions: a certain plugin, a misconfiguration, or an unpatched version. This one is broader. Attackers are actively scanning for it, and they've already figured out how to weaponize it. - **It writes files to disk** – That's persistent. Even if you clean up later, the damage may already be done. - **It executes shell commands** – This isn't just defacement. It's full server compromise. - **It's being exploited in the wild** – No more theoretical risk. Real attacks are happening now. ### What You Should Do Right Now First, don't panic. But don't wait either. Here's a quick checklist: - Check if your WordPress core, themes, and plugins are fully updated. If not, update them immediately. - Look for any unknown files in your uploads or root directories. If you see something suspicious, isolate it. - Consider a web application firewall (WAF) that blocks known exploit patterns for CVE-2026-87902. - If you're not comfortable doing this yourself, hire a security professional. Seriously. This isn't the time to wing it. > "The gap between a vulnerability being disclosed and being exploited is shrinking every year. In this case, it's basically zero." — that's not a quote from a researcher, but it might as well be. The pattern is clear. ### The Bigger Picture for Site Owners WordPress powers over 40% of the web. That makes it a giant target. And while the core team is usually quick to patch, the ecosystem of plugins and themes is vast. One weak link is all it takes. So what's the takeaway? Stay paranoid. Not in a fearful way, but in a prepared way. Back up your site daily. Monitor logs. And treat every update as urgent, not optional. This won't be the last critical WordPress flaw. But if you act fast, it can be the last one that catches you off guard. Stay safe out there. And maybe check your site right now—just to be sure.