Hackers exploited a critical WordPress flaw within hours of the patch

Attackers began exploiting a critical WordPress flaw within hours of the fix. The bug, CVE-2026-87902, can let an attacker with no login run code on a website’s server. It only works under certain conditions. WordPress fixed the flaw in version 7.1.2 on 22 September. It also patched every older branch back to 4.7. Its security […]
This story continues at The Next Web