A newly disclosed vulnerability in WordPress has seen swift exploitation, with active compromises occurring shortly after its public announcement, according to cybersecurity firm Patchstack.
Details of the Vulnerability
The vulnerability, identified as CVE-2026-87902 with a CVSS score of 9.2, is a path traversal flaw within WordPress’ page-template resolution system. This flaw potentially allows unauthenticated attackers to execute remote code under specific conditions.
According to WordPress, the security issue can be exploited when an attacker makes the get_page_template() function include a predefined, readable local .php file from outside the active theme directories. This can lead to remote code execution if certain server and theme conditions are satisfied.
Conditions for Exploitation
The security risk arises when the top-level directory name of the active child or parent theme begins with ‘page-‘. Additionally, if the server account can read a specific local .php target file, the vulnerability can be triggered.
Particularly, the well-known pearcmd.php in PEAR can be leveraged for remote code execution when the register_argc_argv setting is enabled. This affects the official PHP Docker image and the default cPanel setup when using PHP versions prior to 8.5.
Impact and Response
The flaw impacts themes with certain directory layouts, including WordPress’ older themes like Twenty Twelve and Twenty Fourteen, as well as third-party themes such as Neve, Hestia, and Sydney. WordPress addressed this security issue in version 7.1.2 on September 22, with patches backported to earlier versions down to 4.7.x.
Patchstack reports that exploitation attempts began mere hours after the vulnerability was disclosed, initially for reconnaissance. By September 23, these attempts had escalated to actual compromises, originating from a small group of IP addresses.
The volume of malicious traffic targeting this vulnerability has significantly increased, spreading across a wider range of websites. The attack process involves initial vulnerability verification, followed by PEAR inclusion checks, and ends with abusing pearcmd.php to execute remote code.
Considering the availability of public scanning tools, Patchstack anticipates a rise in activities surrounding CVE-2026-87902. Website administrators are urged to update their WordPress installations and apply necessary security measures to safeguard against potential attacks.
For further information on recent security updates, see related articles on WordPress’ Click2Shell patch, Adobe’s critical flaw fixes, and the urgent patching of Arista’s VCO zero-day.
