CISA has confirmed exploitation of WordPress CVE-2026-87902. Site owners should install a fixed release, verify deployment, preserve logs, and check exposed systems for suspicious changes.