WordPress Vulnerability CVE-2026-87902 Exploited: Update to 7.1.2

Summary

A critical WordPress vulnerability, CVE-2026-87902, was being exploited within hours of the patch being released on 22 September 2026. The flaw in WordPress core lets an unauthenticated attacker make WordPress run a readable .php file on the server as a page template (local file inclusion, LFI). When certain conditions are met, this becomes remote code execution (RCE). According to the official advisory, the default cPanel configuration with PHP versions before 8.5 meets one of those conditions, which makes this urgent for business websites on shared hosting.

• CVSS 4.0: 9.2 (Critical) – no authentication or user interaction required.
• Affected versions: WordPress 4.7.0 to 7.1.1. The fix shipped in WordPress 7.1.2 and was backported to every branch down to 4.7.37.
• Actively exploited: Patchstack saw the first attempts on 22 September at 11:49 UTC; attempts to write PHP files to disk via pearcmd.php started the same day. A ready-made Nuclei scanning template has been circulating since 23 September.
• CISA KEV: Added to the catalog on 25 September 2026, with a remediation deadline of 28 September for US federal agencies.

WordPress vulnerability: technical details

The bug sits in get_page_template(), the function that decides which template file WordPress uses for a page. By placing encoded path traversal sequences (%2e%2e) in the pagename parameter, an attacker can make WordPress include a readable .php file outside the active theme directories. According to Patchstack, the requests also carry a page_id that resolves to a real page; without it WordPress returns a 404 and the vulnerable code path is never reached.

Two preconditions turn the file inclusion into code execution:

1. Theme: The active theme (child or parent) has a top-level directory whose name starts with page-, such as page-templates. The advisory names the legacy Twenty Twelve and Twenty Fourteen themes as well as popular third-party themes Neve, Hestia and Sydney.
2. Server: A suitable .php file readable by the web server account exists on the server. Attackers use PEAR's pearcmd.php for this. With register_argc_argv enabled in PHP, the query string is passed to pearcmd as command-line arguments, allowing the attacker to write a PHP file with arbitrary content to disk. The advisory states that the official php Docker image and the default cPanel configuration with PHP before 8.5 are affected.

Patchstack describes three stages of attack traffic: first, probes against harmless core files such as wp-links-opml.php to test whether the inclusion works; second, +config-show requests to confirm pearcmd is reachable; third, +config-create requests that write PHP files to /tmp or /var/tmp, which amounts to code execution. Previdian's honeypots also recorded requests trying to pull a web shell uploader hosted on GitHub.

Affected and fixed versions

Because WordPress installs security releases automatically by default, many sites will already be patched; Previdian expects many exploitation attempts but relatively few actual compromises for that reason. Sites with automatic updates disabled or failed updates remain exposed.

Is my WordPress site affected? Checklist

1. WordPress version: Check Dashboard › Updates in wp-admin. If your version is equal to or newer than the fixed release for your branch in the table, you are patched against this flaw.
2. Theme directory: In the cPanel File Manager, open wp-content/themes/ and check whether the active theme (and its parent theme, if you use a child theme) has a top-level folder starting with page-.
3. PEAR: Check whether pearcmd.php exists on the server. The paths attackers try are /usr/local/lib/php/pearcmd.php, /usr/share/php/pearcmd.php and /usr/share/pear/pearcmd.php. On shared hosting, ask your hosting provider if you cannot see these folders.
4. register_argc_argv: Check whether this setting is On in cPanel's MultiPHP INI Editor or PHP options, or in the phpinfo() output. Delete any phpinfo file you create once you are done.
5. Indicators of compromise (IoCs): Look for unexpected .php files in /tmp and /var/tmp, in particular poc87902.php, wp-pear-rce-flag.php, luci_*.php and zeta_*.php. According to Patchstack, their presence means a file-write attack succeeded and the host should be treated as compromised, not merely scanned. If you have no access to these folders, ask your hosting provider to check.
6. Access logs: In your raw access logs, search for %2e%2e or %252e%252e in the pagename parameter, pagename values starting with templates%2f, pagename and page_id in the same request, the strings pearcmd, +config-show and +config-create, and the user agents cve-2026-87902-poc/1.0 and nuclei-cve-2026-87902/1.0. A 200 response containing OPML or RSS output from a normal page URL shows that the inclusion ran on your site.

What to do now

1. Update WordPress immediately to 7.1.2 or the fixed release for your branch (7.0.6, 6.9.9, 6.8.10 … 4.7.37). Take a backup first. Since the fix was backported to all branches, older sites can be patched without a major version upgrade.
2. Check /tmp and /var/tmp for the IoC files above and review your logs back to 22 September.
3. If you find signs of compromise: change all WordPress admin passwords, cPanel/FTP and database passwords, and regenerate the security keys (salts) in wp-config.php. Review unknown admin accounts and files, and restore from a clean backup if needed.
4. Mind your breach notification duties: If personal data such as customer or employee records was accessed, the GDPR (and Turkey's KVKK) generally require notifying the data protection authority within 72 hours of becoming aware of the breach.
5. Keep automatic updates on: Make sure automatic security updates for WordPress core have not been disabled.

Can't update right away? Temporary workarounds

These do not replace the patch; they only reduce the risk until you can update:

• Disable register_argc_argv in PHP. This does not fix the inclusion, but it breaks the pearcmd chain to code execution.
• Remove PEAR if you do not need it; on shared hosting, ask your provider.
• Block requests with %2e%2e or %252e%252e in the pagename parameter at your web application firewall (WAF). POST requests now outnumber GET in the attack traffic, so the rule must cover both the query string and the POST body. Legitimate page slugs never contain these sequences, so normal traffic is not affected.

Timeline (UTC)

• 22 September 2026: WordPress 7.1.2 and backported fixes released; advisory GHSA-7hp8-65ch-5whp published.
• 22 September, 11:49: Patchstack observes the first exploitation attempt (reconnaissance against harmless core files).
• 22 September, 15:34: First attempt to write a file to disk via pearcmd.php.
• 23 September: Public scanning tooling, including a named Nuclei template, in circulation; attack volume peaks around midday.
• 25 September: CISA adds CVE-2026-87902 to its Known Exploited Vulnerabilities (KEV) catalog.
• 28 September: Remediation deadline for US federal agencies.

Also patch Elementor to 4.3.2

Versions 4.3.0 and 4.3.1 of the Elementor Website Builder plugin contain a CSRF flaw that lets an attacker create a new administrator account by getting a logged-in admin to open a single link. The flaw has no CVE yet and is fixed in Elementor 4.3.2. If you use Elementor, update the plugin too and check your user list for unknown administrator accounts.

How Doğa Network can help

Our team can help with WordPress version and theme checks, safe updates, PHP settings, WAF rules and reviewing your site for signs of compromise. Call us on +90 850 888 3642 or email hi@doga.network.

Sources

• WordPress – Security advisory GHSA-7hp8-65ch-5whp
• Patchstack – CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
• The Hacker News – Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
• CISA – Known Exploited Vulnerabilities Catalog
• NVD – CVE-2026-87902
• BleepingComputer – Elementor WordPress flaw lets attackers create admin accounts