WordPress CVE-2026-87902: Active Exploitation

A critical WordPress vulnerability, CVE-2026-87902, is already being exploited in the wild shortly after its public disclosure. The flaw is rated 9.2 out of 10 under CVSS and can lead to remote code execution (RCE) when specific conditions exist in the WordPress installation.
If you run a WordPress site, updating is the most important first step. Sites that may have been exposed should also be checked for signs of previous exploitation.

---

What Is CVE-2026-87902?​

CVE-2026-87902 affects the way WordPress handles the get_page_template() function, which is responsible for determining the template used to render a page.
Under specific conditions, an unauthenticated attacker can abuse the template selection process to make WordPress include a local PHP file chosen by the attacker.

For exploitation to work, two important conditions must be present:

• The active parent or child theme must contain a top-level directory whose name starts with page-, such as page-templates.
• A local PHP file selected during the attack must already exist on the server and be readable by the web server account.

This means the vulnerability does not automatically affect every WordPress installation. However, installations that meet the required conditions can be exposed to a serious attack path.

---

How the Exploitation Works​

The attack can use an existing PHP file on the server as part of an exploitation chain.
Security researchers observed attackers attempting to access:

/usr/local/lib/php/pearcmd.php

The observed activity then attempted to use the file to write a PHP file into /tmp, followed by an attempt to include a custom PHP script hosted on GitHub.
This behavior suggests that attackers were moving beyond simple vulnerability testing toward creating PHP files that could potentially provide command execution on the server.
⚠️ Do not assume that installing the security update alone proves that a previously targeted site is clean.

---

Active Exploitation Has Already Been Observed​

Previdian reported exploitation attempts against its honeypot systems shortly after CVE-2026-87902 was publicly disclosed.
According to the reported observations:

• The first activity appeared shortly after the vulnerability became public.
• Previdian recorded 68 exploitation attempts beginning September 23, 2026.
• Some activity was associated with an IP address in New Jersey, while other attempts were linked to Indonesia.
• Patchstack observed the first exploitation attempt on September 22, 2026, at 11:49 UTC.
• Attackers attempted to create PHP files in locations such as /tmp and /var/tmp.

Several filenames were observed, including:

wp-pear-rce-flag.php
poc87902.php
luci_
zeta_

Randomized filenames were also observed during the activity.

---

What Attackers Are Looking For​

The observed activity indicates that attackers may first perform reconnaissance before attempting exploitation.
Patchstack reported a progression from requests targeting harmless core files to more direct exploitation attempts involving pearcmd.php and the creation of PHP files on disk.
This type of activity is important because a successful attacker may be able to create a PHP file that can later be used to maintain access to the compromised server.

---

Affected WordPress Versions and Security Updates​

WordPress released security updates addressing CVE-2026-87902.
The reported fixed versions include:

• WordPress 7.1.2
• WordPress 7.0.6
• WordPress 6.9.9
• WordPress 6.8.10

Administrators should install the appropriate security release for their WordPress branch as soon as possible, especially because exploitation has already been observed.

---

How to Check a WordPress Site After the Attack Began​

Updating WordPress should be the first step, but administrators should also investigate whether the site was targeted before the update was installed.
Check your web server and security logs for unusual requests, particularly requests involving: pearcmd.php
Also inspect temporary directories for unfamiliar PHP files:

/tmp
/var/tmp

Look for:

• Newly created PHP files.
• Unknown filenames.
• Unexpected files inside temporary directories.
• Requests involving pearcmd.php.
• Suspicious activity around the time exploitation began.
• PHP files that appeared without a legitimate deployment or plugin operation.

If you discover evidence that an attacker successfully wrote a PHP file to the server, treat the incident as a potential compromise rather than assuming the update completely resolved the problem.

---

What WordPress Administrators Should Do​

A practical response is:

1. Update WordPress to the appropriate security release.
2. Review server and WordPress logs for suspicious requests.
3. Search /tmp and /var/tmp for unexpected PHP files.
4. Investigate unknown PHP files before deleting them if they may be useful as forensic evidence.
5. Review the site for signs of persistence if exploitation appears to have succeeded.
6. Perform a full security review before considering a potentially compromised site clean.

🔎 The last step is especially important for sites that were running a vulnerable configuration while exploitation was already taking place.

---

Why the Rapid Exploitation Matters​

The short time between public disclosure and observed exploitation highlights the risk of newly disclosed vulnerabilities in widely deployed software.
Once technical details become available, attackers can analyze the underlying weakness and develop requests designed to target unpatched installations.
WordPress sites that receive automatic security updates may have a shorter exposure window, but administrators should not rely on automatic updates alone when active exploitation has already been reported.

---

Bottom Line​

CVE-2026-87902 is a critical WordPress vulnerability with a reported CVSS score of 9.2, and exploitation attempts have already been observed.
The vulnerability requires specific conditions involving the active theme and locally accessible PHP files, so not every WordPress installation is automatically exploitable. However, affected sites should be updated immediately.
If your site may have been exposed before the update, check logs and temporary directories for signs of exploitation. Finding an unexpected PHP file or other evidence of successful exploitation means the site should undergo a full security investigation rather than being considered safe simply because the WordPress version has been updated.

---

Frequently Asked Questions​

-------------------

Is CVE-2026-87902 actively exploited?​

Yes. Exploitation attempts were reported by security researchers shortly after the vulnerability was publicly disclosed.

Does CVE-2026-87902 affect every WordPress site?​

No. Successful exploitation depends on specific conditions involving the active theme and a local PHP file that is available to the web server account.

What should I do first?​

Update WordPress to the appropriate fixed version for your branch as soon as possible.

Should I check my site after updating?​

Yes, especially if the site was running a vulnerable version while exploitation was already being observed. Review logs and inspect /tmp and /var/tmp for suspicious PHP files.

What if I find an unfamiliar PHP file?​

Treat it as a potential indicator of compromise and investigate the server before assuming the file is harmless or simply deleting it.