WordPress under active attack — patch Core before Friday

Half the public web runs WordPress. Less than a day after the patch shipped, attackers moved from probing to writing PHP to disk. That forgotten marketing site still counts.

That forgotten marketing site still counts.

CVE-2026-87902 is an unauthenticated page-template path traversal that can include a local PHP file outside the theme. Under common theme + PHP settings, that inclusion becomes remote code execution. Patchstack saw reconnaissance within hours of WordPress 7.1.2; by September 23 the same operators were using pearcmd to drop shell tags in /tmp. Nuclei templates are public. If you still run anything between 4.7 and 7.1.1, update today.

What happened

On September 22, WordPress released 7.1.2 (and backports down to 4.7.37) for CVE-2026-87902, a critical (CVSS 9.2) unauthenticated local file inclusion in get_page_template(). Researcher Robert Ressl reported it privately; the bug skips validate_file() on a pagename-built template candidate.

Patchstack observed first malicious requests at 11:49 UTC on September 22, the same day as the advisory. Traffic climbed an order of magnitude by September 23 and moved through three stages: (1) include harmless core files to confirm the inclusion works, (2) include pearcmd.php with +config-show to confirm PEAR + register_argc_argv, (3) +config-create to write attacker-controlled PHP under /tmp and /var/tmp (names like wp-pear-rce-flag.php, poc87902.php, luci_.php, zeta_.php). Some payloads are markers; others execute a shell command on access.

Public scanners now include nuclei-cve-2026-87902/1.0 and cve-2026-87902-poc/1.0. Official PHP Docker images and default cPanel configs (PHP before 8.5) are called out as affected for the pearcmd chain.

Why it matters

No login is needed and the tooling is automated, so attackers can spray every WordPress site they find. A successful stage-three write means the host is compromised from the attacker’s point of view even if the first drop lands in /tmp. The same primitive can write somewhere web-reachable next.

Sites that auto-update may already be safe. Everything else is a target right now, especially old branches, managed hosts that lag, and themes with a top-level page-* directory.

What to do first

• Update Core immediately to 7.1.2, or the matching security release on your branch (7.0.6 / 6.9.9 / 6.8.10 … down to 4.7.37). Verify the version on disk; do not assume auto-update landed.
• If you cannot patch in the next hour: WAF/reject pagename values containing traversal (%2e%2e, %252e%252e, ../) — real slugs never need those.
• Disable register_argc_argv where you can (breaks the pearcmd RCE chain; does not fix the inclusion itself).
• Hunt access logs for pagename + page_id together, pearcmd, +config-show, +config-create, and the named Nuclei/PoC user-agents.
• Check /tmp and /var/tmp for unexpected .php files; treat finds as compromise, not “just a scan.”
• Review themes for a top-level page-* directory (e.g. page-templates) — that is a key precondition.

Details

• CVE: CVE-2026-87902 — path traversal → LFI → conditional RCE (CVSS 9.2)
• Affected: WordPress Core 4.7.0–7.1.1
• Fixed: 7.1.2 and backports through 4.7.37 (pre-4.7: no fix)
• Auth: None
• RCE preconditions: theme top-level page-* dir; readable local .php target (often PEAR pearcmd.php); register_argc_argv for the argv/pearcmd chain
• First observed: 2026-09-22; file-write stage by ~15:34 UTC same day; commoditized by 2026-09-23

Hunt / verify

• Confirm wp-includes/version.php shows a fixed release.
• Search logs for %2e%2e / %252e%252e in pagename, templates%2f prefixes, paired page_id+pagename on / or /index.php, and OPML/RSS body returned from a normal page URL (stage-one success).
• Host check: unexpected PHP under /tmp, /var/tmp; unknown admin users, plugins, themes, webshells.

Confirm wp-includes/version.php shows 7.1.2 (or your branch’s security release); hunt pagename traversal + pearcmd; wipe unexpected PHP under /tmp.

Sources

• https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/
• https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
• https://ressl.ch/blog/cve-2026-87902-wordpress/
• https://wordpress.org/news/ (7.1.2 / GHSA-7hp8-65ch-5whp)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].