# Hackers start exploiting critical WordPress flaw for code execution

> **Newsylist Open Intelligence Dossier** · First detected: 2026-09-24 08:29 UTC · Category: Technology · Sources: 6 · Current Velocity: 4.29

## Key People, Organizations & Locations
Hackers, WordPress

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| Security Affairs | CVE-2026-87902: how close is your WordPress to remote code execution? | 2026-09-23 18:31 | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxQeFA5Q2dFcklDSnREZWltWmg1aGxYd1JJMUlRY3JWb21RRmVaT1NGNHdRN3pick5UMUNmRFR5ZG5FY1kwN2VpQ3FHQWhCT1ZROVVjME9YTXpwVHZTNXJEWWU3aUVScDM5SFgyNlVxTndTMml5TWctbkVGXzkyTFc2QmdidWpBcktucGtlQ2VNdWllWEQ2T1RHV3RrMExPU0p2TEJMbHhxTDZOMVQtSElIQ0FOLUJRZ9IBuwFBVV95cUxOUE1qc09SS19WYXY3TFpsTDlYcDV5UXB0OEtqa2RSZzVrNXZwTFE1MHZqXzEzdXNiOEVvcThTQ1ZtNElEZUJHNzhtWk5LRFVWX2pfdTRrMUJPREp2UVROQ01ZamlNdVAyWjgteE1BelF3SHFlQjNIQ1h0SXEwZ1dZT01Jckk1cTZ4UEh6enFsZmRHZmdZQkJCeDc2XzJ) |
| forkast.news | WordPress Core Patched in Hours. Attackers Were Already Inside. | 2026-09-23 18:31 | [Source Link](https://news.google.com/rss/articles/CBMiiwFBVV95cUxQN0EtYTFrODhFcEowSFcwWUZCWl9JbXBsNktfd0ZFcUcwU2xrbjNMLXF1aGtlR2s3bkd3bXRzQlU1b3BDN3UyaG5TekM4MTFaS2xZXzY5UDZmV2JWek5rWU5lbTVtQktTaUlEYXFVMWl5blR0cmR4WlBZekpiSEJ4YnRMaFptQnBKM0pj?oc=5) |
| SecurityWeek | WordPress Patches ‘Click2Shell’ Vulnerability | 2026-09-23 18:31 | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE95bEY3aXdIdElqSGtrMmh1Sk13ck5nLV83dUVUQ0N4X0JJUW0wWXVmclNxcGVTb3NLd2xPbW4tQ2Z0X1JhMk13d2EzV0VmY0hmMGRCcnlkVmpTd2ZyVjk4N2U4YkNLZ21DOWktYUJaVnNMWUptQ1VDY3lRT2MwUdIBgwFBVV95cUxNVmxwcVM0MjYxaHd6R1NHdmpXSTgtVXBrRDNWdjh1MmdzX3JEdGVmbGtDUzBwSlVHQkJHb3ZHRVpvMXpNWGxiQWozWkltM0lFSk5ta2JzaTdMc0V6UVZUNEtlRW5WRU1HVnp4bWhodS1RVWt3dm5tOWhjRnpodEtIbDlCVQ?oc=5) |
| The Hacker News | WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers | 2026-09-23 18:31 | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTFBxOGJITVYxa00yUV9iYzZLOVh4cEZ5bkZyblJ1U3JTRWxTekR0ZkVOWno3cG1semlra1VoYWl6c0pOUjZmbWdxckpEWGd0bnNMUWJzTzNUZlNjNTFWUWg2R29nRUtoZ3FDRUpsNTlMWnJuOEtPems2SDdvbUQtSmM?oc=5) |
| BleepingComputer | Hackers start exploiting critical WordPress flaw for code execution | 2026-09-23 18:31 | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxPOXR2dWR2UUtnZVR0ZWJiSEVaUjJJMk05OG4wNUFpQ2FzVDk4ZnlUOEFfUkxiOXlHb0J4SXNZbGxQSWF0MmlvUDlJbnRjQjlDTnluMFlEWUNNMWRwRHh3THBvMFluWFo1Q0pOQ25ONWtJTUFIV3RxX1NuOGdubURJcGEtcDNDVTEyalNObkhMUFZDTGptMjg1VkhTNTRlSEc0X1FJVUVIQ0VHVVgySGNSVzdEaW9HQdIBuwFBVV95cUxQYm9fRXMyUUQ3WUZ2NlJjdlhwOGE5QmZoaFY2Ym5ZZWlPdG9OejF0SVhVZmxnZ3RmYnZRLWxYaTk5V2tGeFhZUHRpZGVTUW9OUTJwR2ZTTnhEUWpERERNN1l5cXoxS09IZzdia3gxNWx6Y0FNZXlZaDRSdnFvM19uV2xRWDZYaUowa0I4eWJjQ1BCUWZmb1JFX3IyTDF) |
| Help Net Security | WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) | 2026-09-22 18:03 | [Source Link](https://news.google.com/rss/articles/CBMilgFBVV95cUxNLXNPUjFxUFY2RkRqZ3c5Tmk4XzU2TllEQ1R6UTRGaHNGaWVGTmpRUTRpZ1FkWGZDSHVJaXdYQVRaMnQ2V2NRdWRDNmRqZi1Memk3c196N2VTVlhsMTZBeVBySG9tc2lNTTlPNllyLXQ0NTZUT0hvckgzN2tqLV9iRUgycGZnS2tuRzJWLWtqT3Qxb1h6V3c?oc=5) |
| The Hacker News | Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure | 2026-09-22 18:03 | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxQWlZqdDJMbGltTkJQNU9KZFgwRDdEa0sxZGZDNmdDdWduYk56bXJLcVJPRV9GRnVTOGNldHlaWHRYSFBDaTUtcDhQSWd2UmtwOTFUdjkzdDdxTVMzRFB0T3p3dW43Unh1UFJrWThaa0dlTXBJM2ZnZm1UemZIUDNOUA?oc=5) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-09-24/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*