WordPress patches a critical severity security vulnerability
WordPress patched critical unauthenticated RCE CVE-2026-87902 in 7.1.2; attackers weaponized pearcmd.php within hours of disclosure.
WordPress 7.1.2 fixes CVE-2026-87902 (CVSS 9.2), where an unauthenticated attacker can make page template resolution include an arbitrary local PHP file outside theme directories, leading to RCE, with fixes backported to version 4.7. Patchstack telemetry shows reconnaissance within five hours of the September 22 release and full exploitation within about a day, with attackers abusing pearcmd.php to write malicious PHP to /tmp before loading it via the flaw. Traffic volume increased roughly tenfold in a day as scanning shifted to payload delivery, and public scanning tooling for the CVE is in circulation.
- CVE-2026-87902: unauthenticated RCE in WordPress, CVSS 9.2, fixed in 7.1.2
- Exploitation observed within hours of patch release; traffic up tenfold in a day
- Attackers abuse pearcmd.php to write payloads to /tmp before loading them
- Fix backported to WordPress 4.7; many older versions affected
- CVEs
- CVE-2026-87902
- Organizations
- WordPressPatchstackRobert Ressl
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
5 min read at csoonline.com
WordPress has patched what it described as a critical severity security vulnerability that would allow an unauthenticated attacker full remote code execution (RCE) capabilities. There have already been reports of attacks in the wild. Given its popularity, WordPress has frequently been under attack, and patched another maximum severity bug allowing RCE in July.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.