According to reports, attackers are using the vulnerability to write malicious files to disk. When those files are accessed, they execute shell commands on the server, giving the attacker a foothold for further compromise. This progression from mass probing to live exploitation signals that a working exploit is circulating and that unpatched sites face immediate risk.

Key points:

• The flaw is tracked as CVE-2026-87902.
• Attackers are writing files to disk that run shell commands when requested.
• The activity has moved from scanning to active exploitation, suggesting attackers have a functional method of attack.

If your organization runs WordPress, treat this as urgent: verify your version against vendor guidance, apply any available patches, and monitor your web server for unexpected files or outbound shell activity. Review logs for suspicious file writes in web-accessible directories, since that is the behavior described in the reported attacks.

Source: BleepingComputer

Has anyone seen signs of this activity in their web server logs, and how are you handling patching or virtual patching in the meantime?