WordPress CVE-2026-87902 now exploited for code execution

Attackers have moved beyond scanning for WordPress sites vulnerable to CVE-2026-87902. They are now exploiting the flaw to plant files that run shell commands when they are accessed, according to WordPress security firm Patchstack.

The vulnerability was fixed in WordPress 7.1.2. Scanning began less than five hours after that release. Since then, malicious traffic has grown tenfold, and attackers are now trying to deliver payloads.

Patchstack says it saw the first malicious requests at 17:44 UTC on September 22. They came from a small group of IP addresses and targeted several sites under the company's protection.

A path traversal bug with a critical rating

Security researcher Robert Ressl discovered the issue. It is a path traversal bug that needs no authentication and can lead to remote code execution (RCE) under certain conditions. Path traversal flaws let an attacker reach files outside the directories an application is meant to use.

The WordPress security team rated CVE-2026-87902 as critical, with a score of 9.2 out of 10.

According to the official advisory, an unauthenticated attacker can force the page-template resolution in get_page_template() to include a readable local .php file of the attacker's choosing, even if that file sits outside the active theme directories.

Code execution is not possible on every site. Several conditions have to be met:

• The active parent or child theme must have a top-level directory whose name starts with page-, such as page-templates.
• The attacker must target a local .php file that exists.
• The web server account must be able to read that file.

The advisory uses pearcmd.php as an example of a usable file when PHP's register_argc_argv setting is enabled. It also names two common setups as affected: the official PHP image for Docker, and the default cPanel configuration when running a PHP version older than 8.5. cPanel is a widely used web hosting control panel.

The fix shipped in WordPress 7.1.2. Because of the severity, the WordPress team also backported it to all branches down to 4.7. The report says releases before 4.6 will not get a fix.

From reconnaissance to writing files

Patchstack says the early traffic was reconnaissance. The attackers tried to include ordinary WordPress core files, most likely to find out which sites were vulnerable.

That changed on September 23. The researchers saw traffic tied to the flaw rise tenfold, and it now includes a stage that writes files to disk.

"The third stage swaps config-show for config-create, which pearcmd will happily use to write a file wherever it is told, with content the attacker controls," Patchstack explained.

Not every payload is harmful. Some only write a string that marks the host as exploitable. Others, however, "write a short tag that executes a shell command on access," which the researchers see as a sign of malicious intent.

The dropped files end up in /tmp and /var/tmp. Observed file names include:

• wp-pear-rce-flag.php
• poc87902.php
• luci_.php
• zeta_.php

Patchstack did not publish a working request. It did say that the probes use double-encoded traversal sequences in the pagename parameter, together with a valid page_id.

The company recommends blocking three source addresses: 169.58.48.193, 169.58.48.195 and 2001:df1:e8c0::106b.

Administrators should update to WordPress 7.1.2 as soon as possible. They should also check their logs for signs of exploitation, including unexpected .php files in the temporary directories listed above.

Our Take

The timeline is the main warning here. Probing began within hours of the patch, and payload delivery started about a day later. This suggests attackers are reading security advisories as closely as defenders do, if not more so. It fits a pattern we have covered repeatedly this month. The Check Point VPN RCE flaw and the Roundcube SQL injection bug were both put to use soon after fixes became available.

The RCE conditions are narrow on paper. Still, the fact that the official Docker PHP image and default cPanel setups are affected means many ordinary hosting environments could qualify. Sites stuck on very old WordPress releases without a backported fix face the highest risk.

It is also worth watching whether the "marker" files are a prelude to larger campaigns. Lists of confirmed vulnerable hosts are useful to anyone planning mass exploitation. Other product flaws have followed that path, as seen with the TeamCity bug now used by ransomware gangs. Patching quickly and checking temporary directories now looks like the safer option.