{"id":244436,"date":"2026-09-24T01:18:18","date_gmt":"2026-09-24T06:18:18","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution"},"modified":"2026-09-24T01:18:18","modified_gmt":"2026-09-24T06:18:18","slug":"hackers-start-exploiting-critical-wordpress-flaw-for-code-execution","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution","title":{"rendered":"Hackers start exploiting critical WordPress flaw for code execution"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution.jpg\"><\/a><\/p>\n<p>Threat actors have moved from probing WordPress sites vulnerable to CVE-2026\u201387902 to exploiting the flaw to write files to disk that execute shell commands when accessed.<\/p>\n<p>Initial attack traffic was only for reconnaissance and started less than five hours after the patch was released in WordPress 7.1.2. Malicious activity increased by ten times, and attackers are now trying to deliver payloads.<\/p>\n<p>WordPress security firm Patchstack reports that it observed the first malicious requests at 17:44 UTC on September 22 from a small group of IP addresses targeting multiple sites under its protection.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat actors have moved from probing WordPress sites vulnerable to CVE-2026\u201387902 to exploiting the flaw to write files to disk that execute shell commands when accessed. Initial attack traffic was only for reconnaissance and started less than five hours after the patch was released in WordPress 7.1.2. Malicious activity increased by ten times, and attackers [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-244436","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=244436"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244436\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=244436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=244436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=244436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}