A critical vulnerability in WordPress, tracked as CVE-2026-87902, has escalated from a reconnaissance threat to an active, weaponized attack. Threat actors are now actively exploiting the flaw to write executable files to a site's disk, a significant shift that dramatically increases the risk for millions of websites.
Security researchers initially observed automated scans probing for vulnerable WordPress installations. That activity has now evolved into full-scale exploitation, with attackers using the flaw to establish persistent access. The exploit requires authentication, meaning attackers must first compromise a user account—either through weak credentials, stolen sessions, or chained plugin vulnerabilities—to gain a foothold.
Once authenticated, the flaw allows an attacker to write arbitrary PHP files directly into the WordPress file system. When these files are accessed via a browser, they execute system-level shell commands, granting the attacker complete control over the server. This can lead to data theft, site defacement, or the server being recruited into a botnet.
Given WordPress's dominant market share, powering over 40% of the web, this vulnerability presents a massive attack surface. The confirmed active exploitation marks a critical juncture, making immediate action essential for all site administrators.
Recommended Incident Response:
- Update Immediately: Patch your WordPress core to the latest version containing the fix for CVE-2026-87902. This is the most critical step.
- Check for Compromise: Audit your server logs for suspicious file creation in core directories. Search for unfamiliar PHP files or unexpected changes to existing files. Review user account activity for anomalous logins.
- Strengthen Monitoring: Deploy real-time file integrity monitoring for the WordPress root directory. Consider a Web Application Firewall (WAF) to provide an additional defensive layer against exploit attempts.
- Apply Least Privilege: Review all WordPress user accounts and ensure they operate with the minimum permissions necessary. Enforce strong authentication and consider multi-factor authentication for all administrative accounts.
The rapid progression from scanning to active, file-writing exploitation underscores the urgent need for a proactive defense-in-depth strategy, moving beyond simple patching to comprehensive monitoring and strict access control.
一個被追蹤為CVE-2026-87902的WordPress關鍵漏洞，已從偵察威脅升級為主動的武器化攻擊。威脅行為者現正積極利用此漏洞，向網站磁碟寫入可執行檔案，這個重大轉變大幅增加了數百萬網站面臨的風險。
安全研究人員最初觀察到針對易受攻擊WordPress安裝的自動化掃描探測活動。該活動目前已演變為全面的漏洞利用，攻擊者利用此漏洞建立持久性存取權限。此漏洞利用需要認證，意味著攻擊者必須先入侵用戶帳戶——透過弱密碼、被盜用的會話，或串聯的外掛漏洞——才能站穩腳跟。
一旦完成認證，此漏洞允許攻擊者直接向WordPress檔案系統寫入任意PHP檔案。當這些檔案透過瀏覽器存取時，會執行系統層級的shell命令，賦予攻擊者對伺服器的完全控制權。這可能導致數據竊取、網站篡改，或伺服器被招募進入殭屍網絡。
鑒於WordPress佔據主導地位，驅動超過40%的網站，此漏洞呈現出龐大的攻擊面。已確認的主動利用標誌著關鍵時刻，要求所有網站管理員立即採取行動。
建議的事故應對措施：
- 立即更新： 將您的WordPress核心程式修補至包含CVE-2026-87902修復程式的最新版本。這是最關鍵的步驟。
- 檢查是否遭入侵： 審計您的伺服器日誌，查找核心目錄中的可疑檔案創建活動。搜尋不熟悉的PHP檔案或現有檔案的意外變更。檢視用戶帳戶活動是否有異常登入。
- 加強監控： 為WordPress根目錄部署實時檔案完整性監控。考慮使用Web Application Firewall (WAF)，以提供額外防禦層，抵禦漏洞利用嘗試。
- 套用最低權限原則： 審查所有WordPress用戶帳戶，確保它們僅以必要的最低權限運作。強制實施強認證，並考慮為所有管理員帳戶啟用多重身份驗證。
從掃描到主動寫入檔案的漏洞利用，其快速進展凸顯了採取主動、縱深防禦策略的迫切需求——超越簡單的修補，走向全面監控與嚴格存取控制。