WordPress: critical core RCE exploited within hours of the patch (CVE-2026-87902)
by Claudiu Hulea · IT Management Consultant
A critical vulnerability in WordPress core, CVE-2026-87902, is already being exploited at scale, within hours of the patch shipping. It is an unauthenticated path traversal, scored CVSS 9.2, that leads to local PHP file inclusion and, on very common setups, to code execution on the server. It is already on the CISA list of actively exploited vulnerabilities. If you run WordPress, update to 7.1.2 now.
What it is, briefly
The flaw is in page-template resolution. An attacker with no account can make get_page_template() include a local .php file located outside the active theme directories. The inclusion itself needs no authentication and depends on no conditions.
The jump from inclusion to code execution is “conditional”: it needs the pearcmd.php gadget present on the server and the PHP setting register_argc_argv enabled. Combined, they allow writing a file that runs shell commands when accessed. We are not spelling out the steps, but the idea is clear: from an unauthenticated request to code on the server.
Who is exposed
The RCE condition sounds niche, but it is not. The pearcmd.php gadget ships by default in two very widespread places: the official PHP Docker image and the default cPanel configuration when a PHP version older than 8.5 is running. Many sites have them without the administrator knowing.
In other words, the file inclusion is universal on vulnerable versions, and code execution is one step away on a large part of the real estate. Do not assume you are safe just because you “do not use PEAR”.
Why it is serious
Three reasons.
It is in the core of WordPress, not a plugin, and it is unauthenticated. No account, no admin click, just a request.
It is critical and confirmed: CVSS 9.2, and CISA added it to the KEV list on 25 September 2026, which means confirmed in-the-wild exploitation.
It is already exploited at scale. According to Patchstack, the first probes appeared at 17:44 UTC on 22 September, under five hours after the patch, and the next day attack traffic jumped tenfold. The discoverer is researcher Robert Ressl.
What to do now
Update to 7.1.2, immediately. The fix is backported to every maintained branch, down to 4.7. Check the actual version of the installation, do not assume the auto-update ran, especially on self-hosted sites.
If you cannot patch on the spot, apply two stopgaps. Reject, at the WAF or server level, any request where the pagename parameter contains .. or %2e%2e. And set register_argc_argv = Off in php.ini, which cuts the pearcmd.php route even if the gadget is present.
Look for signs of compromise. Check /tmp and /var/tmp for dropped files named like wp-pear-rce-flag.php or poc87902.php, unusual requests to pearcmd.php, and traversal patterns in the pagename parameter in the logs. Block the source IPs published by researchers.
What to take away
The lesson is speed. The window between the patch shipping and the first attacks was under five hours, and mass exploitation followed in less than a day. For a core, unauthenticated, KEV-listed vulnerability, a monthly patch-management cycle protects nothing, because the attackers are there the same day.
The right reflex is not just to have auto-update on, but to verify that it ran and that the version on disk is the fixed one. It is the same discipline as everywhere: verify the effect, not the assumption.
Want to know what WordPress versions and PHP configurations actually run on your sites, and how fast you catch a critical patch? Get in touch and we start from a review.
Sources
- BleepingComputer: hackers start exploiting critical WordPress flaw for code execution
- Patchstack: attackers started probing hours after the patch (CVE-2026-87902)
- SecurityWeek: critical WordPress vulnerability exploited immediately after disclosure
- SOCRadar: CVE-2026-87902 in WordPress enables conditional RCE
Frequently asked questions
What is CVE-2026-87902?
A critical WordPress core vulnerability (CVSS 9.2): an unauthenticated path traversal in page-template resolution. An attacker with no account can make get_page_template() include a local .php file outside the active theme directories. On common setups this leads to code execution. It affects versions 4.7.0 through 7.1.1; fixed in 7.1.2, backported down to 4.7.
Why "conditional RCE"?
The local PHP file inclusion is unauthenticated and unconditional. The jump to code execution requires the pearcmd.php gadget present on the server and the PHP setting register_argc_argv enabled. Both are common: the official PHP Docker image and the default cPanel configuration with PHP below 8.5 have them. So many sites are exposed to RCE without knowing it.
Is it being exploited?
Yes. According to Patchstack, the first probes appeared at 17:44 UTC on 22 September 2026, under five hours after the patch shipped, and mass exploitation started the next day with a tenfold jump in traffic. The vulnerability was added to the CISA KEV list on 25 September. Attackers drop files in /tmp and /var/tmp with names like wp-pear-rce-flag.php and poc87902.php.
What should I do?
Update to WordPress 7.1.2 now; the fix is backported down to 4.7. If you cannot patch immediately, two stopgaps: reject requests where the pagename parameter contains .. or %2e%2e (a WAF rule), and set register_argc_argv = Off in php.ini, which neutralises the pearcmd route. Check logs for files dropped in /tmp and /var/tmp and for requests to pearcmd.
