A critical WordPress vulnerability is already being exploited in the wild, with attackers moving from probing to active code execution attempts less than a day after a patch was released. The flaw, tracked as CVE-2026-87902, carries a CVSS score of 9.2 and allows unauthenticated remote code execution under certain server configurations.

What the flaw does

According to the official WordPress advisory, the bug lies in how get_page_template() resolves page templates. An unauthenticated attacker can manipulate this resolution to include a chosen, readable local .php file located outside the active theme directories. For remote code execution to succeed, several conditions must align: the active theme must have a top-level directory whose name starts with page-, a readable local PHP file must exist on the server that the attacker can target, and the web server account must have read access to that file. The advisory cites pearcmd.php as an example when PHP’s register_argc_argv setting is enabled, and notes that the official PHP Docker image and default cPanel configurations running PHP versions before 8.5 are affected.

Exploitation timeline

WordPress shipped a fix in version 7.1.2, with patches backported to every branch down to 4.7 given the severity of the issue. Versions before 4.6 will not receive a fix. Security firm Patchstack, which discovered the researcher Robert Ressl’s find was already being probed, recorded the first malicious requests at 17:44 UTC on September 22, less than five hours after the patch dropped, originating from a small cluster of IP addresses.

Initial traffic focused on reconnaissance, with attackers attempting to include ordinary WordPress core files to identify vulnerable installations. Activity then jumped tenfold, entering a new stage in which attackers swap the config-show command for config-create, letting pearcmd write attacker-controlled content to arbitrary file paths. Some payloads simply mark a host as exploitable, while others plant a short PHP tag that executes shell commands on access, a clear sign of active compromise attempts. Malicious files have been observed in /tmp and /var/tmp using names such as wp-pear-rce-flag.php, poc87902.php, and randomized variants prefixed with luci_ or zeta_.

What defenders should do

Patchstack flagged probes using double-encoded traversal sequences in the ‘pagename’ parameter combined with a valid ‘page_id’, and recommends blocking the source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.

  • Update WordPress to version 7.1.2 immediately
  • Review server logs for suspicious pagename/page_id traversal requests
  • Check for unexpected PHP files in /tmp and /var/tmp
  • Block the known malicious IP addresses

Given the speed of exploitation, administrators running unpatched WordPress installations should treat this as an urgent priority.