Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code
Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.
Patchstack says attackers are actively exploiting CVE-2026-87902, an unauthenticated local file inclusion in WordPress page-template handling with CVSS 9.2. The flaw affects WordPress Core 4.7.0 through 7.1.1 and is fixed in 7.1.2 plus backports including 7.0.6, 6.9.9, 6.8.10, and 4.7.37. Exploitation began on September 22, 2026, and progressed within a day to using PEAR’s pearcmd.php to write PHP files under /tmp and /var/tmp, a chain that can yield remote code execution. Automated Nuclei and public proof-of-concept scanning is now hitting large numbers of sites.
- Unauthenticated local file inclusion in WordPress core, scored CVSS 9.2.
- Affects versions 4.7.0 through 7.1.1; fixed in 7.1.2 and backports.
- Exploitation began September 22, moving from probes to PHP file writes.
- Attackers abuse PEAR pearcmd.php when register_argc_argv is enabled.
- Public PoC and Nuclei user agents show broad automated scanning.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- Patchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
2 min read at cybersecuritynews.com
The critical WordPress vulnerability CVE-2026-87902 is being actively exploited, with activity progressing from reconnaissance to attempts to write malicious PHP files on vulnerable servers. The flaw affects WordPress Core versions 4. 7.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.