WordPress under active attack — patch Core before Friday

Half the public web runs WordPress. Attackers stopped poking and started writing PHP to disk — less than a day after the patch shipped. That forgotten marketing site still counts.

That forgotten marketing site still counts.

CVE-2026-87902 is an unauthenticated page-template path traversal that can include a local PHP file outside the theme. Under common theme + PHP settings, that inclusion becomes remote code execution. Patchstack saw reconnaissance within hours of WordPress 7.1.2; by September 23 the same operators were using pearcmd to drop shell tags in /tmp. Nuclei templates are public. If you still run anything between 4.7 and 7.1.1, this is today — not next week’s maintenance window.

What happened

On September 22, WordPress released 7.1.2 (and backports down to 4.7.37) for CVE-2026-87902, a critical (CVSS 9.2) unauthenticated local file inclusion in get_page_template(). Researcher Robert Ressl reported it privately; the bug skips validate_file() on a pagename-built template candidate.

Patchstack observed first malicious requests at 11:49 UTC on September 22 — the same day as the advisory. Traffic climbed an order of magnitude by September 23 and moved through three stages: (1) include harmless core files to confirm the inclusion works, (2) include pearcmd.php with +config-show to confirm PEAR + register_argc_argv, (3) +config-create to write attacker-controlled PHP under /tmp and /var/tmp (names like wp-pear-rce-flag.php, poc87902.php, luci_.php, zeta_.php). Some payloads are markers; others execute a shell command on access.

Public scanners now include nuclei-cve-2026-87902/1.0 and cve-2026-87902-poc/1.0. Official PHP Docker images and default cPanel configs (PHP before 8.5) are called out as affected for the pearcmd chain.

Why it matters

WordPress’s installed base is the blast radius. Unauth + automated tooling means mass scanning wins by volume, not sophistication. A successful stage-three write means the host is compromised from the attacker’s point of view even if the first drop lands in /tmp — the same primitive can write somewhere web-reachable next.

Sites that auto-update may already be safe. Everything else — especially long-tail branches, managed hosts that lag, and themes with a top-level page-* directory — is in the spray path right now.

What to do first

• Update Core immediately to 7.1.2, or the matching security release on your branch (7.0.6 / 6.9.9 / 6.8.10 … down to 4.7.37). Verify the version on disk; do not assume auto-update landed.
• If you cannot patch in the next hour: WAF/reject pagename values containing traversal (%2e%2e, %252e%252e, ../) — real slugs never need those.
• Disable register_argc_argv where you can (breaks the pearcmd RCE chain; does not fix the inclusion itself).
• Hunt access logs for pagename + page_id together, pearcmd, +config-show, +config-create, and the named Nuclei/PoC user-agents.
• Check /tmp and /var/tmp for unexpected .php files; treat finds as compromise, not “just a scan.”
• Review themes for a top-level page-* directory (e.g. page-templates) — that is a key precondition.

Details

• CVE: CVE-2026-87902 — path traversal → LFI → conditional RCE (CVSS 9.2)
• Affected: WordPress Core 4.7.0–7.1.1
• Fixed: 7.1.2 and backports through 4.7.37 (pre-4.7: no fix)
• Auth: None
• RCE preconditions: theme top-level page-* dir; readable local .php target (often PEAR pearcmd.php); register_argc_argv for the argv/pearcmd chain
• First observed: 2026-09-22; file-write stage by ~15:34 UTC same day; commoditized by 2026-09-23

Hunt / verify

• Confirm wp-includes/version.php shows a fixed release.
• Search logs for %2e%2e / %252e%252e in pagename, templates%2f prefixes, paired page_id+pagename on / or /index.php, and OPML/RSS body returned from a normal page URL (stage-one success).
• Host check: unexpected PHP under /tmp, /var/tmp; unknown admin users, plugins, themes, webshells.

Slack paste: Confirm wp-includes/version.php shows 7.1.2 (or your branch’s security release); hunt pagename traversal + pearcmd; wipe unexpected PHP under /tmp.

Sources

• https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/
• https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
• https://ressl.ch/blog/cve-2026-87902-wordpress/
• https://wordpress.org/news/ (7.1.2 / GHSA-7hp8-65ch-5whp)

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.