Hackers Now Exploiting Critical WordPress Flaw for Remote Code Execution
Threat actors are now actively exploiting CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress, moving beyond early reconnaissance to write files to disk that execute shell commands when accessed. Patchstack observes the first malicious requests at 17:44 UTC on September 22, less than five hours after the patch ships in WordPress 7.1.2, and attack traffic soon increases tenfold as attackers attempt to deliver payloads.
The flaw, discovered by researcher Robert Ressl and rated 9.2 out of 10 by the WordPress security team, lets an unauthenticated attacker make get_page_template() include a chosen readable local .php file outside the active theme directories. Remote code execution requires specific conditions: the site's theme must have a top-level directory whose name starts with "page-", and the targeted .php file must exist and be readable by the web server. The advisory highlights pearcmd.php as an exploitable target when PHP's register_argc_argv setting is active, noting that the official PHP Docker image and default cPanel configurations running PHP before 8.5 are affected.
WordPress releases version 7.1.2 to address the flaw and backports fixes to all branches down to 4.7 due to its critical severity, while releases before 4.6 remain unpatched. In the observed attacks, reconnaissance requests attempt to include ordinary WordPress core files to identify vulnerable sites, while later stages leverage pearcmd's config-create feature to write attacker-controlled files anywhere on disk. Site administrators are urged to update immediately to a patched version.