Back Securityweek

Critical WordPress Vulnerability Exploited Immediately After Disclosure

Securityweek • September 24, 2026

The exploitation of a fresh WordPress vulnerability started within hours of public disclosure and has escalated to active compromises, security firm Patchstack warns.

Tracked as CVE-2026-87902 (CVSS score of 9.2), it is a path traversal flaw in WordPress’ page-template resolution. Under certain conditions, unauthenticated attackers could exploit it for remote code execution.

“An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE,” WordPress’ advisory reads.

The security defect can be triggered if the name of the top-level directory of the active child or parent theme starts with ‘page-‘ and if the web server account can read a chosen local .php target file that exists on the server.

“The well-known pearcmd.php PEAR→RCE transition can be used for this when register_argc_argv is set to On. The official PHP image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use,” the advisory reads.

Pearcmd.php provides a command-line tool for the management of PEAR packages in PHP environments and can be abused for RCE on servers with register_argc_argv enabled, especially when combined with a local file inclusion or a path traversal issue.

According to WordPress, themes that contain the relevant directory layout include the legacy Twenty Twelve and Twenty Fourteen themes, along with third-party themes such as Neve, Hestia, and Sydney.

The security defect was addressed on September 22 in WordPress version 7.1.2 . The fix was also backported to WordPress releases, all the way back to 4.7.x.

Within hours of public disclosure, Patchstack identified the first exploitation attempts targeting CVE-2026-87902.

“The payloads match the exact encoding the patch addresses, so whoever built them was working from the diff rather than from an independent discovery,” the security firm notes.

Originating from a small cluster of IP addresses, the initial exploitation activity was designed for reconnaissance, but escalated to active compromises by September 23, Patchstack says.

“Traffic against this CVE is now running at more than ten times the volume we saw on the first evening; it is reaching a far wider spread of sites, and the requests have moved through three clear stages,” the security firm notes.

The attackers first verify whether the target server is vulnerable, then check for PEAR’s pearcmd.php inclusion, and finally abuse pearcmd.php to write PHP content to achieve RCE.

Patchstack suggests that the activity surrounding CVE-2026-87902 is likely to increase, as public scanning tools exist.

Related: WordPress Patches ‘Click2Shell’ Vulnerability

Related: Adobe Patches Critical Flaws in Connect, AEM Forms

Related: Chrome 154 Patches 108 Vulnerabilities

Related: Arista Urges Immediate Patching of Exploited VCO Zero-Day

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical WordPress Vulnerability CVE-2026-87902 Exploited Within Hours of Disclosure On September 22, 2026, WordPress released version 7.1.2 to address a critical vulnerability, CVE-2026-87902, which allows unauthenticated attackers to exploit a path traversal flaw in the page-template resolution process. This vulnerability, which affects WordPress versions 4.7.0 through 7.1.1, has a CVSS score of 9.2, indicating its critical nature. Attackers can leverage this flaw to include and execute arbitrary PHP files located outside the active theme directories, potentially leading to remote code execution (RCE). Exploitation began within hours of the patch release, with reports of active compromises surfacing shortly thereafter. The vulnerability is particularly dangerous due to its reliance on common server configurations and theme structures, making many installations vulnerable. Security researchers have observed a rapid escalation in exploitation attempts, with tools being developed to automate the attack process. Administrators are urged to update their WordPress installations immediately to mitigate the risk. 44 sources 80

Extracted Entities

Critical WordPress Vulnerability Exploited Immediately After Disclosure

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (3)

Tools (2)