WordPress CVE-2026-87902: Critical Core Flaw Exploited Hours After the 7.1.2 Patch

What WordPress fixed in 7.1.2

WordPress 7.1.2 is a security-only release. In the release post, John Blackbourn describes the issue this way: "An unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories." Under certain server and theme conditions, that inclusion can lead to remote code execution.

The GitHub security advisory, GHSA-7hp8-65ch-5whp, is titled "Unauthenticated path traversal in page-template resolution leading to conditional RCE". It places the bug in get_page_template() and classifies it as CWE-98, improper control of the filename used in a PHP include or require statement. The CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N: network reachable, no login and no user interaction needed, but with attack prerequisites (AT:P) that must be present on the target.

The vulnerability was reported responsibly by Robert Ressl. Affected versions run from WordPress 4.7.0 through 7.1.1, and WordPress backported the fix to every branch from 4.7 onward.

Who is actually exposed

According to the advisory, two conditions have to line up. The first makes the file inclusion possible, and the second turns it into code execution.

1. The active theme, parent or child, contains a top-level directory whose name starts with "page-", such as page-templates. The advisory names Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as affected themes.
2. For remote code execution, a readable PHP file on the server must be usable as a gadget. The advisory points to PEAR's pearcmd.php, which becomes dangerous when PHP's register_argc_argv setting is enabled. It says official Docker PHP images and cPanel with PHP versions before 8.5 are affected.

That narrows the blast radius considerably. Previdian founder and CEO Ryan Dewhurst told The Hacker News: "Although this is undoubtedly a serious vulnerability, certain preconditions make exploitation less likely." WordPress also enables automatic background updates for minor and security releases by default, so many sites will have picked up the fix without anyone touching them.

The sites to worry about are the ones where auto-updates are turned off, pinned or blocked by the host, running one of the affected themes on a PHP stack that ships PEAR.

How fast attackers moved

Patchstack, which deployed a virtual-patching rule the day the advisory went out, published a timeline of what its sensors saw. All times are UTC.

• September 22: advisory published and the fix released.
• September 22, 11:49: first exploitation attempt, probing ordinary core files.
• September 22, 15:34: first attempt to write a file through pearcmd.php.
• September 23: a public Nuclei scanning template is circulating and attack volume peaks around midday.
• September 25: CISA adds CVE-2026-87902 to the KEV catalog.
• September 28: federal remediation deadline.

Patchstack describes three stages. Attackers first ran reconnaissance against ordinary files such as wp-links-opml.php, wp-includes/feed-rss2.php, wp-cron.php and wp-login.php. They then checked for pearcmd.php at /usr/local/lib/php/pearcmd.php, /usr/share/php/pearcmd.php and /usr/share/pear/pearcmd.php. Finally they switched pearcmd from config-show to config-create to write PHP files into /tmp and /var/tmp.

Patchstack, quoted by SecurityWeek, said: "The payloads match the exact encoding the patch addresses, so whoever built them was working from the diff rather than from an independent discovery." SecurityWeek reports that traffic rose more than tenfold by the second day and escalated to active compromises by September 23.

Other sensor networks see a smaller slice. As of September 27, Previdian's page for the CVE lists 407 exploitation attempts from 8 unique IP addresses in 7 countries, first observed on September 23 and last observed on September 26. These are counts from different observers, so they should not be added together.

CISA's KEV listing and the September 28 deadline

CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities catalog on September 25, 2026 as "WordPress Core Remote File Inclusion Vulnerability". The catalog entry sets a due date of September 28, 2026 for federal civilian agencies under Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk", and flags the entry for forensic triage.

CISA lists known ransomware campaign use as "Unknown". The deadline only binds US federal agencies, but a KEV listing is a strong signal for everyone else that exploitation is real and ongoing.

What to do now

Update to the patched build for your branch

The fix is to update. Go to Dashboard > Updates and click "Update Now", or download the release from WordPress.org. Sites with automatic background updates enabled will update on their own, but it is worth confirming the version number rather than assuming.

The fixed build depends on the branch a site runs. The patched versions are:

• 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9
• 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16
• 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23
• 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37

If you cannot update right away

Patchstack's guidance is blunt: "Updating is still the answer, and given stage three it is now urgent." For sites that cannot update immediately, it recommends:

• Rejecting traversal sequences in the pagename parameter at the web server or WAF.
• Disabling register_argc_argv in PHP.
• Auditing /tmp and /var/tmp for unexpected .php files, which indicate compromise.

Signs a site has been targeted

Patchstack lists these detection signals for access logs and file systems:

• A pagename parameter containing %2e%2e or %252e%252e.
• pagename and page_id appearing together in requests to the site root.
• Requests containing pearcmd, +config-show or +config-create.
• User agents cve-2026-87902-poc/1.0 or nuclei-cve-2026-87902/1.0.
• Files named wp-pear-rce-flag.php, poc87902.php, luci_<random>.php or zeta_<random>.php, or any unexpected .php file in /tmp or /var/tmp.

Sources

• WordPress 7.1.2 release post: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
• GitHub advisory GHSA-7hp8-65ch-5whp: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
• Patchstack exploitation timeline: https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
• CISA KEV alert: https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-one-known-exploited-vulnerability-catalog
• Previdian CVE page: https://previdian.com/CVE-2026-87902
• The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html
• SecurityWeek: https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/

Key takeaways

• CVE-2026-87902 is a CVSS 9.2 unauthenticated path-traversal bug in WordPress core page-template resolution, present from 4.7.0 through 7.1.1.
• It is fixed in WordPress 7.1.2 and in backports to every branch down to 4.7.37.
• Exploitation is conditional: it needs a theme with a top-level page- folder, and RCE also needs a readable pearcmd.php with register_argc_argv enabled.
• Patchstack saw the first attack attempt hours after the patch, and file writes through pearcmd.php followed the same day.
• CISA added the flaw to the KEV catalog on September 25 with a September 28 federal deadline.
• Update now, then check /tmp and /var/tmp for unexpected .php files if the site was unpatched after September 22.