A critical vulnerability in WordPress Core is already being targeted in the wild, only hours after details of the flaw became public.
Tracked as CVE-2026-87902, the vulnerability affects WordPress versions going back to the 4.7 branch and can allow an unauthenticated attacker to make WordPress include a local PHP file outside the intended theme directories. Under certain server and theme configurations, this can be escalated to remote code execution (RCE).
WordPress released 7.1.2 on September 22, 2026 to address the vulnerability and began backporting the fix to older security-supported branches.
Security researchers subsequently observed exploitation attempts, including activity attempting to abuse PHP's pearcmd.php to write malicious PHP files to disk.
For companies running WordPress, this is a vulnerability that should be treated as an immediate patching priority.
What is CVE-2026-87902?
CVE-2026-87902 is an unauthenticated path-traversal vulnerability in WordPress page-template resolution.
The flaw exists in the way WordPress processes certain page-template paths. A specially crafted request can manipulate the template-resolution process so that WordPress attempts to load a PHP file located outside the expected theme directory.
This creates a local file inclusion (LFI) primitive.
The attacker does not need a WordPress account to trigger the vulnerable behavior.
WordPress describes the issue as an unauthenticated attacker being able, under relevant conditions, to cause page-template resolution to include a chosen readable local PHP file outside the active theme directories. If additional server and theme conditions are satisfied, that can result in RCE.
How serious is it?
The vulnerability has been assessed at:
- CVSS 4.0: 9.2 — Critical
- CVSS 3.1: 8.1 — High
- Authentication required: No
- User interaction required: No
The difference between the CVSS scores comes from the two scoring systems rather than two different vulnerabilities.
The absence of an authentication requirement is particularly important.
An attacker does not first need to steal an administrator password or obtain a WordPress account. The vulnerable request can be sent anonymously.
However, not every WordPress installation will automatically be exploitable for RCE. The WordPress advisory specifically notes that relevant conditions involving both the server environment and the active theme must be present.
Who is affected?
The vulnerability affects WordPress branches dating back to 4.7.
WordPress released version 7.1.2 as the fix for the current 7.1 branch and is backporting the security fix to older branches that still receive security updates.
Security researchers have documented the affected range as extending from WordPress 4.7.0 through 7.1.1.
The important point for administrators is simple:
Running WordPress 7.1.1 does not protect against this vulnerability.
The 7.1 branch needs to be updated to 7.1.2. Older supported branches should also be updated to their corresponding security releases.
How the vulnerability can lead to RCE
The initial vulnerability is a path-traversal and local-file-inclusion problem.
In a vulnerable environment, WordPress can be manipulated into loading a PHP file that resides outside the intended theme directory.
That becomes much more serious when an attacker can identify a PHP file on the server that can be abused to create or execute attacker-controlled content.
Researchers have demonstrated one such path involving PEAR's pearcmd.php.
The technique depends on additional environmental conditions, including the presence of the relevant PHP file and PHP configuration that allows the required argument handling. Therefore, the PEAR-based route is not guaranteed to work on every WordPress installation.
The important security distinction is:
CVE-2026-87902 itself provides the file-inclusion capability. The final RCE depends on the environment providing a suitable way to turn that capability into code execution.
Attackers moved quickly
The vulnerability became public on September 22, 2026, when WordPress released version 7.1.2.
Security monitoring subsequently detected exploitation attempts within hours.
SecurityWeek, citing Patchstack, reported that the first exploitation attempts appeared shortly after the patch was released. The observed activity initially focused on reconnaissance and vulnerability detection before progressing toward attempts to use pearcmd.php and write PHP files.
The Canadian Centre for Cyber Security also reported on September 23 that open-source reporting indicated CVE-2026-87902 was being exploited in the wild.
This rapid transition from disclosure to exploitation is an important warning for WordPress administrators.
Once a vulnerability is publicly documented, attackers can study the patch and publicly available research to develop scanning and exploitation techniques.
The pearcmd.php connection
One of the most significant developments in the exploitation attempts involves pearcmd.php, a PHP utility associated with PEAR.
Researchers observed attackers attempting to use the WordPress vulnerability to reach this file and then abuse its functionality to create PHP content on the server.
The resulting PHP file can potentially become a webshell, giving an attacker the ability to execute commands through the web server.
Security researchers have observed this behavior in real-world exploitation attempts rather than only in laboratory demonstrations.
However, companies should not assume that the presence of pearcmd.php alone means a server is compromised.
The complete exploitation chain depends on several conditions, including the vulnerable WordPress version, theme structure, filesystem permissions and PHP configuration.
Why the attack is particularly concerning
There are several factors that make CVE-2026-87902 important.
🔴 No login required
An attacker does not need WordPress credentials to reach the vulnerable functionality.
🔴 Core vulnerability
The problem exists in WordPress Core, rather than a single third-party plugin.
🔴 Large historical attack surface
The affected code exists across WordPress branches dating back to version 4.7.
🔴 Public exploitation research
Technical analysis and proof-of-concept material became available shortly after disclosure, reducing the barrier for attackers to develop automated scanners.
🔴 Potential for code execution
Under the appropriate conditions, the file-inclusion primitive can become remote code execution with the privileges available to the web server.
What WordPress administrators should do
✅ Update WordPress immediately
The most important action is to install the appropriate security release.
For the current 7.1 branch, this means upgrading to:
WordPress 7.1.2
Older supported branches should be updated to the corresponding security release containing the CVE-2026-87902 fix.
Do not wait for the next maintenance window if you can safely update sooner.
✅ Check whether automatic updates completed
WordPress supports automatic security updates, but companies should not assume every installation updated successfully.
Check the actual installed version on every production site.
This is particularly important for:
- Managed WordPress installations
- Customer-facing websites
- Older sites
- Development sites exposed to the internet
- Sites managed by external providers
✅ Review web-server logs
Because exploitation attempts were observed shortly after disclosure, administrators should review HTTP and web-server logs for suspicious requests associated with unusual page-template paths or attempts to access local PHP files.
Look for activity occurring around and after September 22, 2026, particularly on systems that were not patched promptly.
✅ Look for unexpected PHP files
If a vulnerable site was exposed after public disclosure, check writable directories for unexpected PHP files.
Particular attention should be given to recently created files in temporary or upload-related locations.
Do not automatically assume that every unfamiliar PHP file is malicious; investigate its origin and creation time before removing evidence.
✅ Check for webshell activity
If exploitation is suspected, review the site for:
- Unexpected PHP files
- New WordPress administrator accounts
- Modified plugins or themes
- Unexpected scheduled tasks
- Changes to
wp-config.php - Unknown outbound connections
- Modified
.htaccessfiles - Unexpected changes to core files
A successful webshell installation may allow an attacker to maintain access even after WordPress itself has been patched.
✅ Rotate credentials if compromise is suspected
If evidence indicates that an attacker achieved code execution, simply updating WordPress is not sufficient.
Companies should consider rotating:
- WordPress administrator passwords
- Hosting credentials
- FTP/SFTP credentials
- SSH keys
- Database credentials
- API keys
- Cloud credentials accessible from the server
The investigation should determine what information was potentially accessible before deciding the full scope of credential rotation.
Companies should also review their PHP environment
The pearcmd.php exploitation chain demonstrates why the security of the underlying server matters.
Companies should review:
- Installed PHP components
- PHP configuration
- File permissions
- Writable directories
- Web-server privileges
- PHP execution permissions
- Whether unnecessary utilities are installed
- Container images and base images
A WordPress vulnerability should not automatically provide an attacker with unrestricted control of the underlying server.
Strong filesystem permissions and application isolation can significantly reduce the impact of successful exploitation.
Why patching WordPress Core is not enough
A secure WordPress deployment requires multiple layers of protection.
Companies should combine:
Current WordPress version
↓
Secure PHP configuration
↓
Restricted filesystem permissions
↓
Web application firewall
↓
Network segmentation
↓
Endpoint and server monitoring
↓
Centralized logging and alerting
This layered approach is particularly important for public-facing WordPress installations.
If an attacker manages to exploit a web application vulnerability, additional controls should prevent the compromise from becoming a complete server takeover.
The bigger cybersecurity lesson
CVE-2026-87902 demonstrates how quickly attackers can react to a newly disclosed vulnerability.
The sequence was particularly short:
Vulnerability disclosure → patch release → public technical analysis → automated probing → active exploitation
That cycle is becoming increasingly common.
Attackers no longer necessarily need months to develop exploitation techniques. Once a patch and technical analysis become public, security teams should assume that automated scanning may follow quickly.
The fact that CVE-2026-87902 is a WordPress Core vulnerability also makes broad scanning particularly practical.
WordPress powers a huge number of websites, meaning a single vulnerable core component can provide attackers with a large potential target population.
Final thoughts
CVE-2026-87902 is a serious WordPress vulnerability, but the technical details matter.
It is not accurate to say that every vulnerable WordPress installation automatically provides unauthenticated RCE. The core flaw is an unauthenticated path traversal/local file inclusion, while RCE requires additional conditions in the theme and server environment.
What is confirmed is more than enough to justify immediate action: WordPress released 7.1.2 specifically to address the issue, and security researchers have already observed exploitation attempts in the wild.
When a critical WordPress Core vulnerability becomes public, patching speed matters. Update immediately, verify that the update succeeded, and investigate logs and files if the site remained exposed after disclosure.
