Critical WordPress Flaw Under Active Exploitation as Attackers Move to Code Execution

Patched vulnerability CVE-2026-87902 now being exploited to write malicious files on vulnerable sites

edit

By LineZotpaper

Published24 September 2026

Read Time2 min

Threat actors have escalated attacks on a critical WordPress vulnerability, moving from reconnaissance to active exploitation attempts that write files capable of executing shell commands, according to security firm Patchstack. The flaw, designated CVE-2026-87902 with a severity score of 9.2 out of 10, was patched in WordPress version 7.1.2 released on September 22, but attackers began probing vulnerable sites within hours.

Security researchers at Patchstack reported that the first malicious requests targeting the vulnerability began at 17:44 UTC on September 22, less than five hours after WordPress released the security update. Initial activity involved reconnaissance, with attackers attempting to include ordinary WordPress core files to identify vulnerable hosts.

Discovered by security researcher Robert Ressl, CVE-2026-87902 is an unauthenticated path traversal bug that, under specific conditions, can lead to remote code execution. The flaw affects the get_page_template() function, allowing attackers to include a chosen readable local PHP file outside active theme directories.

According to the official advisory on GitHub, exploitation requires that the active parent or child theme have a top-level directory with a name starting with 'page-', and the targeted local PHP file must exist and be readable by the web server. The advisory notes that Docker's official PHP image is affected, along with default cPanel configurations using PHP versions before 8.5.

WordPress has backported fixes to all branches down to version 4.7 due to the vulnerability's critical severity, but releases before 4.6 will not receive patches.

Patchstack observed that reconnaissance activity has now escalated to active exploitation. Attackers are using tools such as pearcmd.php in conjunction with double-encoded traversal sequences in the 'pagename' parameter alongside a valid 'page_id'. The attacks involve a config-create stage that writes files to disk with attacker-controlled content.

Some payloads merely write a marker file to indicate the host is exploitable. However, researchers also identified payloads that "write a short tag that executes a shell command on access," indicating malicious intent. Delivered files are written to /tmp and /var/tmp directories with names such as wp-pear-rce-flag.php, poc87902.php, and files beginning with 'luci_' or 'zeta_' followed by random characters.

The source IPs to block, according to Patchstack, include 169.58.48.193, 169.58.48.195, and the IPv6 address 2001:df1:e8c0::106b.

Analysis

Why This Matters

Over 40% of the web runs on WordPress, making this a widespread threat to websites of all sizes.
Attackers moved to active exploitation within 24 hours of the patch, demonstrating a rapid escalation that site administrators must match with urgent patching.
The ability to execute shell commands means attackers could completely compromise affected servers, leading to data theft, malware distribution, or site defacement.

Background

WordPress, the most widely used content management system, regularly issues security patches. Critical vulnerabilities that enable remote code execution are rare but carry severe consequences. This flaw (CVE-2026-87902) is particularly concerning because it requires no authentication to exploit, though it does rely on specific server configurations and theme structures being present. The rapid exploitation timeline mirrors past critical WordPress flaws where attackers leveraged public disclosure to compromise unpatched sites at scale.

Key Perspectives

[WordPress Security Team]: Assesses the flaw as critical (9.2/10) and has taken the unusual step of backporting fixes to versions as old as 4.7, indicating the severity and wide potential impact. [Patchstack and Security Researchers]: Warn that active exploitation is underway and escalating, with attackers now writing files to disk. They recommend immediate patching and blocking identified malicious IPs. [Website Administrators]: Face a race against time to apply the security update across all sites, especially those running older WordPress versions that may no longer be supported or harder to update.

What to Watch

Rate of successful compromise attempts versus patching speed across the WordPress ecosystem.
Emergence of additional exploit variants that bypass patch protections for sites running older PHP versions.
Potential targeting of WordPress hosting providers, which could see mass exploitation if they are slow to update their platforms.

Sources

Hackers start exploiting critical WordPress flaw for code execution — BleepingComputer