Attackers started probing a critical WordPress flaw within hours of its patch, a speed that leaves little room for slow maintenance windows.
The flaw, CVE-2026-87902, was scored 9.2. It lets an unauthenticated attacker steer the page-template resolution routine into pulling in a readable local .php file from outside the active theme directories. Where the server setup and the theme line up, that path hands an attacker code execution on the host. WordPress published the advisory two days before the first exploitation.
Previdian, a security firm running honeypots, counted 68 exploitation attempts from September 23, 2026 onward, with the earliest arriving on September 22 at 11:49 UTC, the same day the patches appeared. The traffic reached for a local PHP component, dropped files into temporary directories, and fetched an uploader script from GitHub. Source addresses traced to New Jersey and Indonesia. Patchstack logged the same progression, from harmless probing of core files to live file writes.
Healthcare organisations run WordPress for public sites, clinic pages, and patient-facing content, so an unauthenticated route to code execution is a direct risk to any hospital web estate. Administrators should move to WordPress 7.1.2, 7.0.6, 6.9.9, or 6.8.10 and audit for the file names and paths above. Auto-updates are on by default, which should blunt mass exploitation, but lagging sites stay exposed.
