Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code
Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.
Patchstack says attackers are actively exploiting CVE-2026-87902, an unauthenticated local file inclusion in WordPress page-template handling with CVSS 9.2. The flaw affects WordPress Core 4.7.0 through 7.1.1 and is fixed in 7.1.2 plus backports including 7.0.6, 6.9.9, 6.8.10, and 4.7.37. Exploitation began on September 22, 2026, and progressed within a day to using PEAR’s pearcmd.php to write PHP files under /tmp and /var/tmp, a chain that can yield remote code execution. Automated Nuclei and public proof-of-concept scanning is now hitting large numbers of sites.
- Unauthenticated local file inclusion in WordPress core, scored CVSS 9.2.
- Affects versions 4.7.0 through 7.1.1; fixed in 7.1.2 and backports.
- Exploitation began September 22, moving from probes to PHP file writes.
- Attackers abuse PEAR pearcmd.php when register_argc_argv is enabled.
- Public PoC and Nuclei user agents show broad automated scanning.
- CVEs
- CVE-2026-87902
- Products
- WordPressChromeSharePointChatGPT
- Threat actors
- PrevidianPatchstackGTG-1002
- Victims
- artists’ marketplace
- Organizations
- PatchstackWordPressRobert ResslPrevidianCanadian Centre for Cyber SecurityCISASTAR LabsMicrosoftGoogleTrellixKasperskyViettel Cyber Security
- Countries
- IndonesiaCanadaUnited StatesChina
Coverage
oldest first · one row per article · UTC- · Sep 23, 2026
Help Net SecurityFirst report
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.
- · Sep 23, 2026
GBHackers
Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code
WordPress 7.1.2 patches a critical CVSS 9.2 path traversal flaw (CVE-2026-87902) that could allow unauthenticated RCE under specific theme and server configurations.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |