HACKERS ARE TARGETING A CRITICAL WORDPRESS FLAW, SO BE ON YOUR GUARD

**Critical WordPress Flaw Under Attack: Patch Now or Risk Losing Control**

A high-severity vulnerability in WordPress, tracked as CVE-2026-87902, is being actively exploited by hackers, putting millions of websites at risk of takeover. Discovered by security researcher Robert Ressl, this unauthenticated path traversal flaw affects WordPress Core and can lead to local PHP file inclusion and remote code execution (RCE).

**WordPress Users Urged to Patch Immediately**

WordPress, the world's number one website hosting and builder platform, is warning users to upgrade to the latest version (7.1.2) to prevent their sites from being compromised. According to the official security advisory, the vulnerability can be exploited by an unauthenticated attacker to include a chosen readable local .php file outside the active theme directories. This can lead to RCE, allowing attackers to execute malicious code and take control of the website.

**Who's at Risk?**

Not all WordPress users are affected, but those with parent or child themes that have a top-level directory with a name starting with 'page-' (e.g., 'page-templates') are at risk. Additionally, the web server account must be able to read the included file, and the web server must be running a PHP version before 8.5.

**Patchstack Reports Widespread Attacks**

WordPress security company Patchstack has reported that the first exploitation attempts started just hours after the patch was released. Initially, the attacks were reconnaissance efforts, but they quickly escalated, with attackers attempting to deliver malicious payloads to vulnerable websites. Patchstack advises website admins to block individual IP addresses, but warns that this strategy is no longer viable as the attacks have become widespread.

**What to Do If You Can't Update Immediately**

For those who cannot update immediately, Patchstack recommends rejecting traversal sequences in the pagename parameter. This can be done without affecting normal traffic, as a real page slug never contains such sequences.

**Stay Protected with Antivirus Software**

In addition to patching your WordPress site, make sure to use reputable antivirus software to protect against malware and other online threats. Our top-rated antivirus software can help you stay safe online.

**Conclusion**

The critical WordPress flaw is a reminder of the importance of regular security updates and patches. With hackers actively exploiting this vulnerability, it's essential to act quickly to protect your website. By patching your site and taking additional security measures, you can prevent a potentially disastrous data breach and maintain the integrity of your online presence.

Stay informed about the latest cybersecurity threats and vulnerabilities by following our blog, Hacker Pranks. Whether you're a seasoned security professional or a tech enthusiast, we've got you covered with the latest news, research, and analysis on hacking, cybersecurity, and related topics.