Exploitation of CVE-2026-87902 has moved beyond initial reconnaissance, with threat actors now leveraging the vulnerability to deposit files on disk that run shell commands upon access. The shift from probing to active payload delivery occurred within days of WordPress releasing a patch, with initial malicious requests detected less than five hours after version 7.1.2 became available.

Security firm Patchstack documented the first hostile requests arriving at 17:44 UTC on September 22, originating from a limited set of IP addresses that targeted multiple sites monitored by the company. Within the following days, the volume of attack traffic surged tenfold as adversaries transitioned to a file-writing phase.

Security researcher Robert Ressl discovered the vulnerability, which the WordPress security team classified as critical with a severity score of 9.2 out of 10. The flaw is an unauthenticated path traversal issue capable of enabling remote code execution under specific circumstances.

According to the official advisory, "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories."

Conditions Required for Remote Code Execution

Successful exploitation depends on several prerequisites being met on the target system:

  • The active parent or child theme must contain a top-level directory whose name begins with page-, such as page-templates, and the attacker must identify a local .PHP file that exists and the web server can read
  • The included file must be accessible by the web server process; the advisory cites pearcmd.php as an example when PHP's register_argc_argv setting is enabled

The advisory highlights that both the official PHP Docker image and the default cPanel setup using PHP versions prior to 8.5 are vulnerable to this flaw.

Patch Availability and Coverage

WordPress released version 7.1.2 yesterday to address CVE-2026-87902, and the fix has been backported across all supported branches back to version 4.7 due to the critical nature of the vulnerability. Installations running version 4.6 and earlier will not receive patches for this issue.

Attack Progression and Payloads

During the initial reconnaissance phase, attackers targeted standard WordPress core files to identify susceptible installations. Patchstack observed that starting today, the attack pattern shifted significantly, with traffic volume increasing tenfold and now including a file-writing component.

In the exploitation sequence, attackers swap config-show for config-create, allowing pearcmd to write files to arbitrary locations with attacker-controlled content. While some payloads merely inscribe a marker string identifying the host as compromised via CVE-2026-87902, researchers also detected payloads that "write a short tag that executes a shell command on access," demonstrating genuine malicious intent.

Deposited files appear in /tmp and /var/tmp directories with names including wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php. Although Patchstack refrained from publishing a functional proof-of-concept request, the firm noted that observed probes employ double-encoded traversal sequences in the 'pagename' parameter alongside a legitimate 'page_id' value.

Threat Actor Infrastructure

Three source IP addresses have been identified in the attack campaign and should be added to network blocklists: 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.

Recommended Actions

Given the ongoing exploitation activity, site administrators must prioritize updating to WordPress 7.1.2 immediately and examine server logs for evidence of malicious requests and file creation.