Active exploitation begins for critical WordPress RCE vulnerability CVE-2026-87902

Attackers have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw. Under certain conditions, an unauthenticated attacker can write files to disk that execute shell commands when accessed.