Secure web applications & APIs with ease. Get fully managed web app firewall & scanner to prevent DDoS & Bot attacks.

Attackers are exploiting WordPress CVE-2026-87902 to include pearcmd.php and write PHP files when specific theme and server conditions are met.

CISA has added one new vulnerability to its KEV Catalog, based on evidence of active exploitation.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.

Hackers started exploiting CVE-2026-87902, a critical WordPress flaw leading to RCE, within hours of public disclosure.

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

WordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution.

WordPress has released version 7.1.2 to address a critical path-traversal vulnerability, tracked as CVE-2026-87902, which could allow unauthenticated remote code execution (RCE) under specific server ...

WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.

コンテンツマネジメントシステムの「WordPress」に深刻な脆弱性が明らかとなった。前週に公開されたセキュリティアップデートで修正した脆弱性とは異なる問題であり、再度更新が必要となる。 ：Security NEXT

CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template... critical severity. Runnable script, captured...

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

WordPressで企業サイト・ブログを運用しているWeb担当者、制作会社の保守担当者向けの記事です。 2026年9月22日、WordPress本体(コア)の脆弱性 CVE-2026-87902 を修正したセキュリティリリース 7.1.2 が公開されました。ログイン不要で、...

Secure web applications & APIs with ease. Get fully managed web app firewall & scanner to prevent DDoS & Bot attacks.

2026年9月22日、WordPressは、WordPress Coreに深刻な脆弱性が確認されたとして、修正版を公開、さらに4.7系までの古い系列にも同様に修正を提供しました。ここでは関連する情報をまとめます。 どんな脆弱性が確認されたの? WordPress Coreのページテンプレートの解決(get_page_template())で、認証不要の攻撃者が、一定の条件下で、有効なテーマのディレ...

2026年9月22日、WordPressは、WordPress Coreに深刻な脆弱性が確認されたとして、修正版を公開、さらに4.7系までの古い系列にも同様に修正を提供しました。ここでは関連する情報をまとめます。 どんな脆弱性が確認されたの? WordPress Coreのページテンプレートの解決(get_page_template())で、認証不要の攻撃者が、一定の条件下で、有効なテーマのディレクトリ外にある読み取り可能なローカルPHPファイルをインクルードさせられる。サーバー環境と有効なテーマの双方の前提条件を満たす場合は、リモートコード実行(RCE)に至りうる*1。(出典: 1, 3, …

# What the WordPress 4.7.0 to 7.1.1 file inclusion bug teaches about patch windows WordPress 7.1.2 was released on 22 September 2026 to fix a remote file inclusion flaw tracked as CVE-2026-87902. The interesting part of this event is not the vulnerability class. It is the timeline. Attack attempts were observed within hours of the patch, and the fix was back-ported to every maintained branch going back to 4.7 [1][2]. According to the project advisory summarized in security reporting, an unauthenticated attacker can manipulate the page template resolution logic in the `get_page_template()` function so that it includes a readable local PHP file from outside the active theme directory [1][3]. ## The conditions that turn inclusion into code execution Public analysis is careful to note two preconditions. The active parent or child theme must contain a top-level directory whose name starts with `page-`, and the server must host a target PHP file that the web service account can read [1][3]. The example that appears in observed traffic is `pearcmd.php`, which ships with the PEAR package manager on many Linux distributions. When it is reachable and PHP is configured with `register_argc_argv` enabled, the inclusion can be turned into writing files into temporary directories and then executing attacker-controlled content [3][4]. Those conditions are restrictive compared with a universally exploitable bug, and reporting reflects that. Honeypot networks operated by the security firm Previdian recorded sixty-eight exploitation attempts against the flaw, with early requests originating from an address in New Jersey and some later traffic from Indonesian ranges [4][5]. Attackers were observed probing with harmless core files first and only then moving to PEAR installation paths, which is the recognizable reconnaissance-into-exploitation sequence. ## Why the patch window was effectively zero The first recorded attempt appeared on the same day the patched version shipped [4]. Automated scanners do not need to understand an organization. They need a list of hosts and a request template, and WordPress provides both because so many sites expose a detectable version. That has a direct consequence for people who run WordPress. The decision that matters is not whether the bug is exploited in the wild, because the evidence already says it is. The decision is how fast the site can move from the vulnerable version to 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9 or the back-ported 4.7.37 release [3][4]. ## Mitigations before the upgrade lands Managed hosting, restrictive file permissions and a staging process all slow a one-click upgrade. Several mitigations reduce exposure in the meantime. Block path traversal patterns in the `pagename` parameter at the web application firewall, recognizing that encodings varied widely in observed traffic and a single rule is unlikely to catch every variant [4]. Disable `register_argc_argv` in the PHP configuration, which breaks the PEAR-based step of the chain while leaving the underlying inclusion defect in place [4]. Check `/tmp` and `/var/tmp` for PHP files that no one recognizes. Reporting mentions specific artifacts such as `wp-pear-rce-flag.php`, `poc87902.php` and randomly named files with prefixes like `luci_` and `zeta_` [4]. Audit themes for directories matching the `page-` pattern, since the official Twenty Twelve and Twenty Fourteen families are among the themes that satisfy that precondition [3]. ## What the case changes about routine maintenance Automatic background updates cover security releases on many installations, and reporting credits them with reducing the affected population. The population that remains is the awkward one: sites pinned to an old version, sites with auto-updates disabled by a plugin, and sites whose hosting panel has not refreshed its PHP runtime in years [4]. For defenders, three changes are worth making permanent. Turn on automatic minor and security updates unless a documented compatibility reason prevents it. Keep a list of installed themes and know which ones satisfy the `page-` directory precondition. Treat temporary directory monitoring as part of incident response rather than as a one-off check after a report like this one. The vulnerability itself is a reminder that template resolution code sits on the request path for every page view. The response is a reminder that the interval between disclosure and exploitation keeps shrinking. ## References 1. FreeBuf, attackers exploit WordPress CVE-2026-87902 within hours of disclosure: https://www.freebuf.com/column/503179.html 2. Tenable vulnerability record noting in-the-wild exploitation of the WordPress Core flaw: https://www.tenable.com/cve 3. Analysis of affected versions and remediation branches for CVE-2026-87902: https://blog.csdn.net/ylscode/article/details/166488284 4. Reporting on observed exploitation technique and temporary mitigations: https://blog.csdn.net/ylscode/article/details/166645724 5. NVD record for CVE-2026-87902: https://nvd.nist.gov/vuln/detail/CVE-2026-87902