WordPress CVE-2026-87902 Is Under Active Attack

Attackers have begun exploiting a critical WordPress vulnerability only hours after the project shipped a patch, according to monitoring by two security vendors. The flaw is tracked as CVE-2026-87902 and carries a CVSS severity score of 9.2, which is considered critical. An unauthenticated attacker, meaning someone with no login to the site, could use it to achieve remote code execution (RCE), which allows the attacker to run their own code on the website's server.

WordPress described the problem in an advisory as a flaw in page template resolution inside the get_page_template() function. In normal operation, WordPress looks for a template file when it builds a page. The vulnerability can make that lookup include a chosen readable local .php file from outside the active theme directories. If two preconditions are met, this can lead to RCE. First, the active child theme or parent theme must have a top-level directory whose name starts with page-, for example page-templates. Second, a chosen local .php target file must already exist on the server and be readable by the account that runs the web server, for example pearcmd.php.

Previdian said in a statement shared with The Hacker News that its honeypot network has observed exploitation attempts against CVE-2026-87902. Honeypots are decoy systems that log malicious traffic before it can do harm. The requests came from an IP address, 104.194.9[.]227, located in New Jersey in the United States. The malicious requests include the local PHP file /usr/local/lib/php/pearcmd.php, use it to write a file to the /tmp/ directory, and then include a PHP upload script hosted on GitHub at raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php.

Previdian founder and CEO Ryan Dewhurst said that although the vulnerability is serious, the preconditions make exploitation less likely on many websites. He added that because WordPress has automatic updates enabled by default, the outcome will likely be a large number of exploitation attempts but relatively few actual compromises. Previdian telemetry recorded a total of 68 exploitation attempts starting on September 23, 2026, and some of the efforts also originated from an IP address in Indonesia.

Patchstack, a WordPress security company, separately warned that the malicious requests have expanded from reconnaissance against harmless core files to active exploitation in which attackers include pearcmd.php and use it to write PHP files to disk. This matches the activity observed by Previdian. Patchstack said the first exploitation effort was recorded on September 22, 2026, at 11:49 a.m. UTC, the same day patches were shipped for the flaw. The activity involves arbitrary file writes with attacker-controlled PHP content in locations such as /tmp and /var/tmp. Observed file names include wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php, where the random part is generated by the attacker to make detection harder.

Several IP addresses have been linked to the malicious attacks, including 43.250.53[.]42, 180.251.159[.]243, 195.178.110[.]247, 107.189.14[.]87, 45.61.184[.]170, and 92.246.130[.]76. Because active exploitation is underway, website administrators are advised to apply WordPress version 7.1.2, or one of the backported security releases 7.0.6, 6.9.9, and 6.8.10, as soon as possible. Administrators should also audit their sites for signs of malicious activity, such as unexpected PHP files or changes in directories like /tmp and /var/tmp.

For site owners who would rather have a provider handle routine WordPress maintenance, AEU Hosting offers managed WordPress hosting with security built in, which reduces the chance a site is left unpatched after a disclosure like this. Automatic updates help, but confirming the update landed and checking for unusual files remains a good step for anyone running WordPress.