Attackers begin exploiting a critical WordPress vulnerability, tracked as CVE-2026-87902, shortly after it becomes publicly known. SecurityWeek and The Hacker News both report that the flaw enables remote, unauthenticated attackers to reach remote code execution.
Both outlets describe the issue as a path traversal vulnerability that can affect how WordPress resolves page templates. The Hacker News adds technical detail, saying an unauthenticated attacker can abuse page-template resolution to include a chosen readable local PHP file. SecurityWeek characterizes the same underlying risk as allowing arbitrary code execution.
The main difference in outlet coverage is emphasis rather than substance: SecurityWeek focuses on the “immediately after disclosure” exploitation timeline, while The Hacker News frames it as occurring “within hours of disclosure” and highlights the CVSS 9.2 score and the specific mechanism involving get_page_template().
