Security Intelligence
Loading table of contents...
At a glance:
-
Exploitation attempts targeting CVE-2026-87902 began within hours of the September 22 release of WordPress 7.1.2, with activity quickly progressing from reconnaissance to exploitation attempts.
-
Internet-facing WordPress sites running affected versions face the greatest exposure, particularly where deployment and configuration conditions allow the vulnerability to be successfully exploited.
-
Review affected WordPress deployments, apply the September 22 security updates, and investigate systems for signs of exploitation.
Threat summary
On September 22, 2026, researchers observed exploitation attempts targeting WordPress sites within hours of WordPress releasing version 7.1.2. The activity followed the September 21 release of WordPress 7.1.1, which addressed the Click2Shell and Comment2Shell vulnerabilities, making this the second WordPress security update released within two days.
Shortly after the patch was released, researchers observed reconnaissance activity, with threat actors probing to determine whether a WordPress site would load files outside the intended theme directory. By September 23, the activity had progressed to file-creation attempts showing that threat actors quickly moved from identifying susceptible targets to attempting to gain access on systems that met the documented exploitation requirements.
The newly patched vulnerability, CVE-2026-87902, is an unauthenticated path traversal flaw affecting WordPress Core versions 4.7.0 through 7.1.1. It has a Common Vulnerability Scoring System (CVSS) score of 9.2.
The vulnerability affects the page-template resolution process, which WordPress uses to determine which template file is loaded when rendering a page. A specially crafted request can cause WordPress to access a readable PHP file located outside the active theme directory.
Exploitation depends on both the WordPress deployment and the underlying server configuration. The active theme must contain a top-level directory beginning with page-, such as page-templates. WordPress identified several examples of themes containing this structure, including:
-
Twenty Twelve
-
Twenty Fourteen
-
Neve
-
Hestia
-
Sydney
Authentication and user interaction are not required.
Public research highlighted pearcmd.php, a utility included with some PHP installations, because it provided a demonstrated path beyond file access. Researchers showed that, when additional server-side conditions are present, pearcmd.php can be used to create new PHP files on the server. Threat actors were later observed targeting the same file during exploitation attempts.
While reporting has focused on pearcmd.php, it is one example of a PHP file that can be reached through the vulnerability rather than a requirement for exploitation. WordPress characterizes the issue as capable of leading to remote code execution when the required theme and server-side conditions are present.
Analysis
Internet-facing WordPress deployments face the greatest exposure because the vulnerability can be reached remotely without authentication. Public websites, customer portals, e-commerce platforms, and externally accessible content management systems warrant priority review.
Threat actors are likely interested in the vulnerability because WordPress often hosts business-critical applications and stores sensitive information such as website content, customer data, application configuration, and credentials used to connect to databases or external services. A compromise of the underlying server can provide access well beyond the website itself.
The operational impact depends on the role of the affected system. A standalone company website may primarily expose website content and administrative accounts. A WordPress deployment integrated with payment systems, customer portals, cloud services, or internal applications could expose additional systems, data, and credentials.
The extent of any downstream access depends on the permissions assigned to the web server account and the resources accessible from the compromised host.
Mitigations
-
Identify WordPress installations across production, development, disaster recovery, and secondary environments, then compare deployed versions against the fixed releases.
-
Upgrade to 7.1.2, 7.0.6, 6.9.9, 6.8.10, or the corresponding security release for older supported branches to remove the vulnerable page-template behavior.
-
Review active themes for top-level directories beginning with page- and validate whether affected systems contain pearcmd.php and the associated PHP configuration required for the publicly documented exploitation chain.
-
Review web server and application logs for requests containing both page_id and pagename, double-encoded traversal strings such as %252e%252e, references to page-templates, and requests for pearcmd.php.
-
Monitor /tmp, /var/tmp, the WordPress document root, and other web-writable locations for newly created PHP files.
-
If indicators of compromise are identified, preserve logs and affected files, investigate whether PHP content was written or executed, and review credentials, service accounts, and integrations accessible from the affected server
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
