Critical WordPress Vulnerability Exploited Immediately After Disclosure
Attackers began exploiting critical WordPress path-traversal CVE-2026-87902 for remote code execution within hours of disclosure.
Patchstack says exploitation of WordPress CVE-2026-87902, a CVSS 9.2 path-traversal flaw in page-template resolution, started within hours of disclosure and reached active compromises by September 23. Unauthenticated attackers can include a chosen local PHP file and, when theme and server preconditions are met, reach remote code execution, including via pearcmd.php when register_argc_argv is enabled. WordPress patched the issue in version 7.1.2 on September 22 and backported the fix through the 4.7.x line. Attack traffic later ran at more than ten times the first evening's volume and progressed from vulnerability checks to PHP writes.
- CVE-2026-87902 is unauthenticated WordPress path traversal scored CVSS 9.2.
- RCE requires specific theme layouts and a readable local PHP file such as pearcmd.php.
- WordPress 7.1.2 fixed it on September 22, with backports through 4.7.x.
- Patchstack saw reconnaissance within hours and active compromises by September 23.
- Later traffic exceeded ten times the first evening, and public scanners exist.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- PatchstackWordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
2 min read at securityweek.com
Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code. The post Critical WordPress Vulnerability Exploited Immediately After Disclosure appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.