[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2PZHKGGP5BHotLV08LtOVCkysu6oQ8U2JxyIhmApMno":3},{"article":4,"iocs":43,"watch_terms":56,"solutions":57,"lesson":114},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"4ad85746-a7b4-4283-bdd0-59aad52713fe","Hackers start exploiting critical WordPress flaw for code execution","hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-368846","Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]","Threat actors are actively exploiting a critical vulnerability, CVE-2026-87902, in WordPress, allowing for remote code execution. Initially used for reconnaissance, the attacks have escalated to delivering payloads that write malicious files to disk, which execute shell commands upon access. The flaw, an unauthenticated path traversal bug, has a critical severity score of 9.2 and affects WordPress versions prior to 7.1.2, with fixes backported to version 4.7.","Hackers exploit critical WordPress flaw CVE-2026-87902 for remote code execution.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-start-exploiting-critical-wordpress-flaw-for-code-execution\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F11\u002F03\u002FWordPress.jpg","2026-09-23T18:31:22+00:00","2026-09-23T20:00:45.290141+00:00",9,[17,20,23],{"name":18,"type":19},"WordPress","product",{"name":21,"type":22},"PHP","technology",{"name":24,"type":19},"cPanel","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,52,54],{"type":45,"value":46,"context":47},"cve","CVE-2026-87902","Critical WordPress vulnerability allowing RCE",{"type":49,"value":50,"context":51},"ip","169.58.48.193","Source IP observed in reconnaissance activity",{"type":49,"value":53,"context":51},"169.58.48.195",{"type":49,"value":55,"context":51},"2001:df1:e8c0::106b",[18,24],{"controls":58,"vendors":113},[59,88],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,97,105],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":89,"product_name":94,"url":95,"description":96},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[],{"slug":115,"title":116,"body":117,"framework_refs":118,"framework_notes":130},"critical-wordpress-rce-flaw-actively-exploited-patch-immediately","Critical WordPress RCE Flaw Actively Exploited — Patch Immediately","A critical unauthenticated path traversal vulnerability (CVE-2026-87902) in WordPress, scoring 9.2 on the CVSS scale, is being actively exploited to achieve remote code execution without any authentication required. Attackers initially used the flaw for reconnaissance before escalating to dropping malicious files capable of executing arbitrary shell commands, dramatically raising the risk to affected sites. Any WordPress installation running a version prior to 7.1.2 remains exposed, making delayed patching an unacceptable risk. This incident underscores how quickly threat actors move from vulnerability discovery to weaponized exploitation, often within days of public disclosure, leaving unpatched systems with a dangerously narrow window for remediation.",[119,120,121,122,123,124,125,126,127,128,129],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-6: Audit Record Review and Analysis","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","OWASP Top 10 A01:2021 – Broken Access Control (Path Traversal)","ITIL Change Management: Emergency Change procedures for critical patches","GDPR Article 32: Security of Processing (obligation to protect systems handling personal data)",{}]