WordPress Fixes Severe RCE Flaw Amid Increasing Attack Speed

WordPress has addressed a critical remote code execution (RCE) vulnerability that could enable unauthenticated attackers to execute code remotely, a serious risk given the platform's widespread use. Reports indicate that attacks exploiting this flaw were identified soon after its disclosure.

This latest vulnerability, tracked as CVE-2026-87902, was uncovered by Swiss security researcher Robert Ressl, and is reminiscent of a previous vulnerability patched in July that also allowed RCE. The company emphasized the importance of users updating their systems swiftly, as the patch applies to all versions from 4.7 onward, putting many outdated sites at risk.

The announcement noted that this vulnerability can be exploited under specific conditions, allowing attackers to include a chosen PHP file outside the active theme directories. In response, users were encouraged to take immediate action to safeguard their websites.

According to Noah Kenney, principal consultant at Digital 520, the potential damage from exploiting this flaw is profound. Exploitation could lead to attackers gaining access to sensitive files like wp-config.php, which contains database credentials and authentication keys. This scenario puts organizations at risk of unauthorized changes, including the installation of harmful code.

Escalating Threat Landscape

The rapid pace at which these attacks are initiated has drawn concerning attention from cybersecurity experts. IDC Research Director Philip Harris noted that the swift exploitation of vulnerabilities within hours of their disclosure signifies a new risk paradigm that businesses must navigate. Security firm Patchstack documented attempts to exploit this flaw almost immediately after WordPress released the patch, indicating that modern threats are evolving faster than many organizations can respond.

Harris remarked, “The mean time to exploit for critical vulnerabilities is now negative in some cases, illustrating a worrying trend.” Patchstack confirmed that probing traffic appeared within five hours post-patch release, with a staggering increase in attempts to deliver payloads the following day.

Aman Mahapatra, Chief Strategy Officer at Tribeca Softech, emphasized that the exploit gap is shrinking alarmingly, stating that the actual exploit code can emerge as quickly as the fix is published. The Line between a patch and a roadmap for potential attackers is accelerating at a pace that poses critical challenges for enterprise security management.

Urgent Need for Rapid Responses

One potential strategy to tackle this urgent threat is automating updates. However, the prospect of automated patch management raises concerns among some enterprise CISOs. They're often hesitant to relinquish control, particularly in light of previous incidents where automation led to significant system failures.

Ressl pointed out that merely enabling automatic updates doesn't ensure effectiveness. Proper verification of patch installations remains critical. Organizations need well-tested rollouts that ascertain successful implementations across all relevant installations.

Mahapatra shared insights into the complexities faced by larger enterprises, which often disable automatic updates for oversight reasons. This results in a situation where organizations with sophisticated governance frameworks are often the most vulnerable, as their change control processes hinder timely updates to critical systems.

A security release, as Mahapatra aptly noted, can transform into a guide for attackers within hours. This urgency calls for organizations to implement emergency patching protocols for internet-facing systems, necessitating responses within hours rather than days.

Overlooked Deployments Increasing Vulnerability

Compounding this risk is the prevalence of unnoticed WordPress installations within enterprises. Many organizations operate WordPress sites that, while initially authorized, often slip under the radar of IT management, leading to unpatched vulnerabilities. These can include marketing microsites or legacy applications that have not been migrated properly.

Mahapatra observed that the true exposure from WordPress vulnerabilities tends to be underestimated within organizations, as many do not recognize themselves as WordPress-centric. This misconception leaves various sites weak against exploitation, especially when they remain on outdated versions.

In the finance sector, for example, when conducting external reviews, Mahapatra found that the instances of WordPress typically do not involve corporate sites but rather marketing or subsidiary initiatives that security teams may not even have accounted for in their patching efforts.

As the landscape becomes riskier, organizations must reassess their visibility and governance structures regarding WordPress installations, ensuring that all systems are adequately inventoried and protected. Rapid responses and a proactive approach to cybersecurity will be crucial in mitigating the impacts of newly discovered vulnerabilities.