Last Updated: 2026.09.23
What’s Happening
Yes, there is another RCE in WordPress (terms and conditions may apply).
Actions
Patch immediately.
3 Likes
Thanks for the great post!
Patchstack has their own analysis with further technical details on the vuln.
This has been assigned CVE-2026-87902.
This is being exploited in the wild, although the actors doing the exploitation are (as of yet) unknown.
1 Like
Great first post, thanks for the share! 
2 Likes
