Filtered by category: Tech Radar, tag: patch management × Clear
Hackers are targeting a critical WordPress flaw, so be on your guard
Matched: WordPress
A critical WordPress flaw (CVE-2026-87902), an unauthenticated path traversal bug scored 8.1, allows PHP file inclusion and potential remote code execution. Exploitation began within hours of a patch release, with attackers now writing malicious PHP files to disk across hundreds of IPs. A fix is available in WordPress 7.1.2, backported to version 4.7. Admins unable to update immediately should block traversal sequences in the pagename parameter and disable register_argc_argv.