Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.
The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).
“An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories,” WordPress said in an advisory released two days ago. “If relevant preconditions for both the server environment and the active theme are met, this can lead to RCE.”
Successful exploitation hinges on meeting the two pre-requisites –
- The active child or parent theme contains a top-level directory whose name starts with page- (e.g., page-templates).
- A chosen local .php target file exists on the server and is readable by the web server account. (e.g., pearcmd.php).
In a statement shared with The Hacker News, Previdian said it’s seeing exploitation attempts targeting CVE-2026-87902 against its honeypot network, with the malicious requests originating from an IP address (104.194.9[.]227) located in the U.S. state of New Jersey.
These requests include the local PHP file /usr/local/lib/php/pearcmd.php, writing a file to /tmp/, and then including a PHP upload script hosted on GitHub (“raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php”).
“Although this is undoubtedly a serious vulnerability, certain preconditions make exploitation less likely,” Previdian’s founder and CEO Ryan Dewhurst said. “Because WordPress has auto-updates enabled by default, we’re likely to see mass-exploitation attempts, but relatively few actual compromises.”
Telemetry data from Previdian has recorded a total of 68 exploitation attempts starting September 23, 2026. Some of the efforts have also originated from an Indonesia-based IP address.
WordPress security company Patchstack has also warned that the malicious requests have expanded from reconnaissance against harmless core files to active exploitation in which attackers include “pearcmd.php” and use it to write PHP files to disk, corroborating findings from Previdian.
The first exploitation effort was recorded on September 22, 2026, at 11:49 a.m. UTC, the same day patches were shipped for the flaw. In addition, the activity involves arbitrary file writes with attacker-controlled PHP content in locations like “/tmp” and “/var/tmp.” Observed file names include –
- wp-pear-rce-flag.php
- poc87902.php
- luci_<random>.php
- zeta_<random>.php
Some of the IP addresses linked to the malicious attacks –
- 43.250.53[.]42
- 180.251.159[.]243
- 195.178.110[.]247
- 107.189.14[.]87
- 45.61.184[.]170
- 92.246.130[.]76
In light of active exploitation, website administrators are advised to apply WordPress version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10) as soon as possible and audit for signs of malicious activity.
