Critical WordPress Vulnerability Exploited Immediately After Disclosure

Summary

A critical path traversal vulnerability in WordPress, tracked as CVE-2026-87902, is being actively exploited shortly after its public disclosure. The flaw allows unauthenticated attackers to achieve remote code execution under specific conditions, particularly when combined with the pearcmd.php tool and certain server configurations. Security firm Patchstack warns that exploitation attempts have rapidly increased and are likely to continue rising.

Full text

The exploitation of a fresh WordPress vulnerability started within hours of public disclosure and has escalated to active compromises, security firm Patchstack warns. Tracked as CVE-2026-87902 (CVSS score of 9.2), it is a path traversal flaw in WordPress’ page-template resolution. Under certain conditions, unauthenticated attackers could exploit it for remote code execution. “An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE,” WordPress’ advisory reads. The security defect can be triggered if the name of the top-level directory of the active child or parent theme starts with ‘page-‘ and if the web server account can read a chosen local .php target file that exists on the server. “The well-known pearcmd.php PEAR→RCE transition can be used for this when register_argc_argv is set to On. The official PHP image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use,” the advisory reads. Pearcmd.php provides a command-line tool for the management of PEAR packages in PHP environments and can be abused for RCE on servers with register_argc_argv enabled, especially when combined with a local file inclusion or a path traversal issue.Advertisement. Scroll to continue reading. According to WordPress, themes that contain the relevant directory layout include the legacy Twenty Twelve and Twenty Fourteen themes, along with third-party themes such as Neve, Hestia, and Sydney. The security defect was addressed on September 22 in WordPress version 7.1.2. The fix was also backported to previous WordPress releases, all the way back to 4.7.x. Within hours of public disclosure, Patchstack identified the first exploitation attempts targeting CVE-2026-87902. “The payloads match the exact encoding the patch addresses, so whoever built them was working from the diff rather than from an independent discovery,” the security firm notes. Originating from a small cluster of IP addresses, the initial exploitation activity was designed for reconnaissance, but escalated to active compromises by September 23, Patchstack says. “Traffic against this CVE is now running at more than ten times the volume we saw on the first evening; it is reaching a far wider spread of sites, and the requests have moved through three clear stages,” the security firm notes. The attackers first verify whether the target server is vulnerable, then check for PEAR’s pearcmd.php inclusion, and finally abuse pearcmd.php to write PHP content to achieve RCE. Patchstack suggests that the activity surrounding CVE-2026-87902 is likely to increase, as public scanning tools exist. Related: WordPress Patches ‘Click2Shell’ Vulnerability Related: Adobe Patches Critical Flaws in Connect, AEM Forms Related: Chrome 154 Patches 108 Vulnerabilities Related: Arista Urges Immediate Patching of Exploited VCO Zero-Day Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Arista Urges Immediate Patching of Exploited VCO Zero-DayCritical F5 BIG-IP Vulnerability Exploited as Zero-DayCheck Point Patches Exploited Management Server Zero-DayBigCommerce Data Stolen via Ribon Apps HackRecent ZyXEL Switch Vulnerability Exploited by Chinese HackersMalicious B-tree NPM Package Accumulates Millions of DownloadsWordPress Patches ‘Click2Shell’ VulnerabilityFake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer Latest News IonQ Targets Quantum Error-Correction Bottleneck With Single-CPU DecoderWorries About an AI Internet Takeover Gain New Urgency Among Doomsday ScenariosHoneywell: OT Security Teams Embrace AI, but Autonomy Still RareAdobe Patches Critical Flaws in Connect, AEM FormsAI-Powered Phishing Platform EvilTokens Disrupted by MicrosoftChrome 154 Patches 108 VulnerabilitiesA Look at AI Doomsday Scenarios That Researchers Say Could Put Humanity at RiskOuterlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveGwen Gann has become State Chief Information Security Officer for the State of Washington at WaTech.Pietr Lindahal has been named Vice President and Chief Information Security Officer at Boston Scientific.AI agent identity and enforcement company FIOR has appointed Gemma Ungoed-Thomas as Adviser.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-87902

Entities