Critical WordPress Flaw Under Active Exploitation
Threat actors have moved beyond reconnaissance and are now actively exploiting CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress, to achieve remote code execution. The flaw, discovered by security researcher Robert Ressl, allows attackers to include and execute arbitrary local PHP files outside the active theme directory under specific conditions.
How the Vulnerability Works
The vulnerability resides in the get_page_template() function, which can be manipulated to traverse directories and include a readable .php file from anywhere on the server. For remote code execution to occur, several conditions must be met: the active parent or child theme must contain a top-level directory whose name starts with page- (such as page-templates), the targeted PHP file must exist and be readable by the web server account, and the file must be accessible via the server’s file system.
The advisory cites pearcmd.php as an example of a file that can be exploited when PHP’s register_argc_argv setting is enabled. This file, when included, can be tricked into writing arbitrary content to disk and executing shell commands upon access.
Timeline of Exploitation
Initial probing for vulnerable sites began less than five hours after WordPress released the patch for CVE-2026-87902 in version 7.1.2. Patchstack, a WordPress security firm, first observed malicious requests at 17:44 UTC on September 22, 2026, originating from a small set of IP addresses targeting multiple protected sites.
Since then, malicious activity has increased tenfold. Attackers have progressed from attempting to include core WordPress files (likely to confirm vulnerability) to actively writing malicious payloads to disk. These payloads include files such as wp-pear-rce-flag.php, poc87902.php, luci_random.php, and zeta_random.php, placed in directories like /tmp and /var/tmp.
Nature of the Payloads
Some payloads serve only as markers, writing a simple string to flag a host as exploitable via CVE-2026-87902. However, more dangerous payloads write a short PHP tag that executes a shell command when the file is accessed via HTTP. This confirms that attackers are not only detecting vulnerability but are actively seeking to establish persistent remote access.
The observed attack vectors use double-encoded traversal sequences in the pagename parameter, combined with a valid page_id, to bypass basic input validation and trigger the file inclusion flaw.
Attacker Infrastructure and Indicators of Compromise
Patchstack has identified the following source IP addresses involved in the exploitation attempts and recommends blocking them:
- 169.58.48.193
- 169.58.48.195
- 2001:df1:e8c0::106b
Patch Status and Affected Versions
WordPress addressed CVE-2026-87902 with the release of version 7.1.2. Due to the critical severity of the flaw — rated 9.2 out of 10 by the WordPress security team — fixes have been backported to all maintained branches down to version 4.7. Sites running WordPress versions prior to 4.6 will not receive patches and are strongly advised to upgrade or implement mitigations.
The vulnerability also affects environments using the official PHP Docker image and default cPanel configurations when running PHP versions older than 8.5, due to the interaction between PHP settings and the flawed template resolution logic.
Recommendations for Administrators
Website administrators are urged to update to WordPress 7.1.2 or later immediately. In addition to applying the patch, administrators should review web and server logs for signs of exploitation, particularly requests containing unusual pagename values with encoded path traversal sequences.
Given the speed at which attackers weaponized this flaw — moving from probe to payload delivery within hours of the patch release — timely updates and proactive monitoring are essential to prevent compromise.
Source: BleepingComputer