In a swift reaction to a disclosed vulnerability, attackers have started exploiting a serious flaw in WordPress, identified as CVE-2026-87902, which was made public just hours before. This security issue is rated with a CVSS score of 9.2, highlighting its critical nature, and it enables unauthorized actors to execute remote code.
Understanding the CVE-2026-87902 Vulnerability
The flaw, according to a WordPress advisory, allows an unauthenticated user to manipulate the get_page_template() function to incorporate a specific local .php file outside the active theme directories. This scenario could potentially lead to remote code execution if particular preconditions related to the server environment and the theme are satisfied. These conditions include the presence of a directory name beginning with ‘page-‘ within the active theme and a readable local .php file on the server.
Exploitation Attempts and Recorded Activity
Previdian, a cybersecurity firm, reported observing exploitation efforts targeting this vulnerability through its honeypot network. These attempts, originating from an IP in New Jersey, involve malicious requests that interact with the local PHP file pearcmd.php and execute scripts from GitHub. Although the vulnerability is severe, the specific conditions required for exploitation may limit its impact. However, with WordPress’s default setting of automatic updates, the potential for widespread exploitation attempts remains.
Data from Previdian indicates 68 exploitation attempts as of September 23, 2026, with some originating from IP addresses in Indonesia. Patchstack, a WordPress security company, confirmed these findings, noting a shift from reconnaissance activities to actual exploitation involving PHP file manipulations.
Impact and Recommendations for WordPress Users
The initial exploitation was logged on September 22, 2026, coinciding with the release of patches for the vulnerability. Exploitation activities involve writing attacker-controlled PHP content to temporary directories, using filenames like wp-pear-rce-flag.php, poc87902.php, among others. Several IP addresses associated with these attacks have been identified, suggesting a coordinated effort to exploit this vulnerability.
In response to these active threats, WordPress administrators are strongly advised to update their installations to version 7.1.2 or applicable versions like 7.0.6, 6.9.9, or 6.8.10. Conducting thorough audits for any signs of compromise is also recommended to mitigate potential risks associated with this vulnerability.
