Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do.

WordPress 7.1.1 fixes Click2Shell, which can force theme installs from crafted links and was chained with a theme flaw for code execution.

WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.

The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.

The ability to create web pages with AI is no longer a novelty.However, what is truly difficult in practice is not ...