- Threat actors are actively exploiting a critical WordPress vulnerability, CVE-2026-87902, just hours after its public disclosure.
- The unauthenticated remote code execution (RCE) flaw carries a CVSS score of 9.2 and requires specific server and theme preconditions to be met.
- Exploitation attempts, first recorded on September 22, 2026, include writing malicious PHP files to disk via the “pearcmd.php” local file.
- Website administrators are urged to apply the patched WordPress versions immediately and audit for signs of compromise.
Threat actors have begun actively exploiting a critical security flaw in WordPress within hours of its public disclosure, targeting sites with an unauthenticated remote code execution (RCE) vulnerability. The flaw, tracked as CVE-2026-87902 (CVSS score: 9.2), allows an attacker to manipulate page-template resolution to include a chosen local PHP file, potentially leading to RCE.
According to WordPress’s advisory, successful exploitation hinges on two preconditions: the active theme must contain a top-level directory starting with “page-,” and a readable target PHP file must exist on the server. Previdian reported seeing exploitation attempts against its honeypot network, with malicious requests originating from a U.S.-based IP address in New Jersey.
These requests target the local PHP file /usr/local/lib/php/pearcmd.php to write a file to /tmp/, then include a PHP upload script hosted on GitHub. Telemetry data from Previdian recorded 68 exploitation attempts starting September 23, 2026, with additional activity from an Indonesia-based IP address.
Patchstack has also warned that malicious requests have expanded from reconnaissance to active exploitation, corroborating findings from Previdian. The first exploitation effort was recorded on September 22, 2026, at 11:49 a.m. UTC, the same day patches were shipped.
Consequently, website administrators are advised to apply WordPress version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10) as soon as possible and audit for signs of malicious activity. Observed file names written by attackers include wp-pear-rce-flag.php and poc87902.php.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
