Critical WordPress Vulnerability CVE-2026-87902 Under Active Exploitation for Remote Code Execution

Threat Actors Shift from Reconnaissance to Delivering Payloads That Write Shell-Command Scripts to Disk

Cybersecurity researchers report that threat actors have escalated attacks targeting a critical path traversal vulnerability in WordPress, designated as CVE-2026-87902. What began as initial reconnaissance probing shortly after the patch release has evolved into active exploitation, with malicious traffic increasing tenfold as attackers attempt to deliver payloads that write executable shell command files to disk.

Discovered by security researcher Robert Ressl, the flaw carries a critical severity score of 9.2 out of 10. The vulnerability stems from an unauthenticated path traversal issue within get_page_template() page-template resolution, allowing attackers to include readable local .php files outside active theme directories.

Exploitation Conditions and Observed Payload Activity

According to WordPress and security firm Patchstack, successful remote code execution (RCE) requires specific system conditions:

• Active parent or child themes must feature a top-level directory starting with page- (such as page-templates).
• The target local .PHP file must exist and be readable by the web server account, with pearcmd.php serving as a primary example when PHP’s register_argc_argv setting is active.
• Default configurations like the official PHP Docker image and cPanel setups utilizing PHP versions prior to 8.5 are affected.

Patchstack noted that early reconnaissance attempts targeted standard WordPress core files to identify vulnerable sites. Subsequent traffic waves utilized pearcmd to write arbitrary files containing control content, ranging from flags confirming host vulnerability (wp-pear-rce-flag.php, poc87902.php) to short tags capable of executing shell commands upon access (luci_<random>.php, zeta_<random>.php). Probes have been observed utilizing double-encoded traversal sequences in pagename alongside valid page_id parameters.

Mitigation and Response

In response to the critical severity, WordPress released version 7.1.2 and backported fixes across all branches down to version 4.7 (versions prior to 4.6 will not receive a patch). Website administrators are strongly advised to update to version 7.1.2 immediately and inspect server logs for indicators of compromise. Additionally, security teams recommend blocking known malicious source IP addresses, including 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.