Hackers Exploit Critical WordPress Flaw to Execute Code
Threat actors have begun actively exploiting CVE-2026-87902, a critical WordPress vulnerability that can allow attackers to write files to disk and execute shell commands when those files are accessed.
Initial attack traffic was limited to reconnaissance and began less than five hours after WordPress 7.1.2 was released. Malicious activity has since increased tenfold, with attackers attempting to deliver payloads to vulnerable websites.
Critical WordPress vulnerability now under active exploitation
WordPress security firm Patchstack reports that it observed the first malicious request on September 22 at 17:44 UTC. A small group of IP addresses targeted multiple websites under its protection.
Security researcher Robert Ressl discovered the vulnerability, an unauthenticated path traversal flaw that can lead to remote code execution (RCE) under certain conditions.
The WordPress Security Team rated CVE-2026-87902 as Critical and assigned it a severity score of 9.2 out of 10.
“An unauthenticated attacker can include selected readable local .php files outside the active theme directory in get_page_template() page template resolution.” Read the official advisory.
Conditions required for remote code execution
The following conditions are required for the vulnerability to enable RCE:
- An active parent or child theme must have a top-level directory with a name that starts with
page-, such aspage-templates. Attackers must also target local PHP files that exist and are readable by the web server. - The included files must be readable by the web server account. The advisory cites
pearcmd.phpas an example when the PHPregister_argc_argvsetting is enabled.
The WordPress advisory states that Docker’s official PHP images are affected. The default cPanel configuration is also affected when PHP versions earlier than 8.5 are used.
WordPress 7.1.2 fixes CVE-2026-87902
WordPress addressed CVE-2026-87902 in version 7.1.2. Because of the flaw’s severity, the fix was also backported to all WordPress branches through version 4.7. Releases before version 4.6 do not contain a fix for this defect. See the WordPress 7.1.2 release details.
According to a Patchstack report, the initial reconnaissance attempts included regular WordPress core files to identify websites that were clearly vulnerable.
Attackers write malicious files to disk
Researchers have since observed a tenfold increase in traffic associated with CVE-2026-87902. The newer activity includes a write stage that places files on the victim’s system.
“The third stage replaces config-show with config-create, which pearcmd happily uses to write attacker-controlled content to a file at the specified location.”
Some payloads only write strings that mark a host as exploitable by CVE-2026-87902. However, researchers also observed a payload that “writes a short tag that executes a shell command when accessed,” indicating that attackers are conducting malicious exploitation rather than simple vulnerability testing.
The files are delivered to /tmp and /var/tmp and use names such as wp-pear-rce-flag.php, poc87902.php, luci_[random].php, and zeta_[random].php.
Although Patchstack did not publish an example request, the security firm warned that the observed probe uses a double-encoded traversal sequence in pagename together with a valid page_id.
IP addresses associated with the attacks
Administrators should consider adding the following source IP addresses to their blocklists:
169.58.48.193169.58.48.1952001:df1:e8c0::106b
What WordPress administrators should do
Because CVE-2026-87902 is being actively exploited, website administrators should update to WordPress 7.1.2 as soon as possible and review server and WordPress logs for signs of malicious activity.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com