Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code

The critical WordPress vulnerability CVE-2026-87902 is being actively exploited, with activity progressing from reconnaissance to attempts to write malicious PHP files on vulnerable servers.

The flaw affects WordPress Core versions 4.7.0 through 7.1.1 and has been fixed in WordPress 7.1.2 and backported releases. Patchstack researchers reported that exploitation began on September 22, shortly after the security update was released.

Initial requests targeted harmless WordPress core files to determine whether sites were vulnerable. Within a day, attackers began targeting PEAR’s pearcmd.php utility to create PHP files in temporary directories. This technique can lead to remote code execution.

CVE-2026-87902 is an unauthenticated local file inclusion vulnerability in WordPress page-template resolution. It has a CVSS score of 9.2 and requires no valid WordPress account or user interaction.

Attackers can abuse path traversal sequences in the pagename parameter to force WordPress into loading local PHP files outside of the intended template path. The affected code is located in WordPress’s get_page_template() function.

In vulnerable releases, WordPress URL-decodes a user-controlled page name and constructs a template candidate without applying the same path-validation controls used elsewhere in the function. This can enable a crafted request to escape the theme directory and include an arbitrary local PHP file.

Hackers Exploiting WordPress Vulnerability

Researchers said practical exploitation can become remote code execution when the target server has PEAR installed and PHP’s register_argc_argv option enabled.

Attackers are probing several common pearcmd.php locations, including paths used by Linux distributions and container images. They then use PEAR command handling to attempt to create files with attacker-controlled content.

Observed payloads have written PHP files to /tmp and /var/tmp, including filenames such as wp-pear-rce-flag.php, poc87902.php, and randomised luci_ or zeta_ filenames.

While files created in temporary directories may not always be directly accessible over the web, successful file creation proves that attackers can execute the chain on the server. Organizations should treat such activity as a potential compromise.

The campaign has also become easier to weaponize. Patchstack identified user agents associated with public proof-of-concept and Nuclei scanning activity, indicating that automated scanning tools are now being used against large numbers of WordPress sites.

Attackers have varied traversal depth, encoding formats, request methods, and URLs, making detection rules based on a single request pattern unreliable.

Administrators should immediately update to WordPress 7.1.2 or the patched release for their supported branch. Available fixed versions include 7.1.2, 7.0.6, 6.9.9, 6.8.10, and backports down to 4.7.37.

Until patching is completed, defenders should block traversal patterns in the pagename parameter, inspect logs for encoded traversal strings and references to pearcmd, and review /tmp and /var/tmp for unexpected PHP files.

Turning off register_argc_argv can interrupt the PEAR-based code-execution chain. However, it does not fix the underlying local file inclusion flaw.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC