Just a few hours after WordPress released a second version update this Tuesday, cybercriminals have launched attacks on the critical security vulnerability closed within it. WordPress admins must update their instances quickly. If automatic updates are active, WordPress will apply the fix itself.
The IT security researchers from Patchstack observed initial probing attempts just a few hours after the release of the second update to WordPress 7.1.2 . However, since Wednesday, these are no longer just harmless probing attempts; attackers are now targeting the file “pearcmd.php.” They are attempting to write PHP files to the server’s file system. Additionally, scans with known tools for the vulnerability CVE-2026-87902 (CVSS according to Patchstack 9.2 , risk “ critical ”) have been running. With it, attackers can include local PHP files on the server via a path traversal vulnerability without prior authentication. If the server and active theme meet certain requirements, this can be exploited to execute malicious code.
WordPress versions from 4.7.0 up to and including 7.1.1 are affected. Currently, the fixed versions available are WordPress 7.1.2, 7.0.6, 6.9.9, 6.8.10, as well as backports for all older branches down to 4.7.37 .
Patchstack’s IT security researchers state that traffic to the vulnerability has increased more than tenfold since the first evening. The attacks are multi-stage. Initially – especially on the first day – inclusion attempts target ordinary core files; the server response shows attackers whether the instance is vulnerable. This is followed in the second stage by access to “pearcmd.php,” in three different directories on the host. The third step then transitions from read to write access, using the command “config-create” from “pearcmd.php.”
Attackers write their PHP content into arbitrary files, leading to the execution of malicious code. In the attacks observed so far, files were placed in /tmp and /var/tmp. Filenames included “wp-pear-rce-flag.php,” “poc87902.php,” “luci_ .php,” and “zeta_ .php.” Since the /tmp folder is usually not accessible from the network, IT researchers see this more as evidence of code execution rather than a persistent backdoor. However, the host is still fully compromised; attackers can place files in publicly accessible locations via the same method. Furthermore, some user agents indicate that a public proof-of-concept code and a template for the vulnerability scanner Nuclei are circulating, making attacks very easy now.
The Patchstack analysis also contains indicators of compromise (IOC). IT managers can investigate their WordPress instances to find out if they have already become victims of attacks.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
