> TritonInfoSec News
Home / Sep 25, 2026 / Story
0
#2 The Hacker News general September 24, 2026 at 05:36 UTC

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

By [email protected] (The Hacker News)

AI Summary

CVE-2026-87902, a critical WordPress path traversal vulnerability with a CVSS score of 9.2, was actively exploited within hours of public disclosure, allowing unauthenticated attackers to achieve remote code execution via manipulation of the get_page_template() function to include arbitrary local PHP files. The rapid weaponization underscores the shrinking window between disclosure and exploitation for WordPress flaws. Administrators running affected WordPress installations should apply patches immediately.

Read full article → https://thehackernews.com/2026/09/attackers-exploi…

Relevance score: 87.0/100

# More from September 25

  1. 1
    There's a new way to break RSA that's faster than anything we've seen before Ars Technica Security
  2. 3
    OpenAI hacked Australian Medicare govt site, probed data providers BleepingComputer
  3. 4
    CISA: Ransomware gangs now exploiting critical TeamCity flaw BleepingComputer
  4. 5
    Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges The Record
  5. 6
    Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content The Hacker News
  6. 7
    Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry The Hacker News
  7. 8
    A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You The Hacker News
  8. 9
    Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer The Hacker News
  9. 10
    Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks The Record