Attackers have moved from scanning WordPress sites affected by the critical vulnerability CVE-2026-87902 to actively exploiting it to write files to the server and run shell commands when those files are accessed. Security company Patchstack observed a sharp escalation in activity hours after WordPress released the patch in version 7.1.2.
From Reconnaissance to Payload Execution
The initial attack activity, which appeared intended to identify vulnerable sites, began less than five hours after the patch was released. According to Patchstack, the first malicious requests were recorded at 17:44 UTC on September 22, from a small group of IP addresses targeting several protected sites.
The following day, activity associated with the vulnerability increased tenfold and included a phase involving writing files to disk. Some requests attempted to include ordinary files from the WordPress core, apparently to identify exploitable sites, before moving on to sending malicious payloads.
Nature of the Vulnerability and Exploitation Conditions
Security researcher Robert Ressl discovered an undocumented path traversal flaw that can lead to remote command execution under certain conditions. The vulnerability gives an unauthenticated attacker the ability to make the get_page_template() function include a locally readable PHP file outside the active theme directories. The WordPress security team rated its severity 9.2 out of 10.
Access to command execution requires specific conditions, including the presence of a top-level directory whose name begins with page- within the active parent or child theme, as well as a locally readable PHP file accessible to the web server account. The official advisory cites pearcmd.php as an example when the register_argc_argv setting is enabled.
The advisory also confirmed that the official PHP image used with Docker is affected, in addition to the default configuration in cPanel when using a PHP version older than 8.5.
What Are Attackers Doing Now?
Patchstack observed requests using the pearcmd tool to move from the config-show function to config-create, allowing a file to be written to a location specified by the attacker with attacker-controlled content. Some files were intended only to place a marker proving that the server was exploitable, but the company's researchers also observed files containing a short tag that executes a shell command when the file is opened.
The observed files were placed in the /tmp and /var/tmp paths and had names such as wp-pear-rce-flag.php, poc87902.php, luci_<random>.php, and zeta_<random>.php. The company did not publish a complete practical request, but said the attempts use twice-encoded path traversal sequences inside pagename with a valid page_id value.
What Should Be Done?
WordPress released version 7.1.2 to address CVE-2026-87902, and the fix was also backported to branches through version 4.7 because of the vulnerability's severity. Versions older than 4.6 will not receive a fix for it.
Site administrators should update to version 7.1.2 as soon as possible, then review logs for suspicious requests and unusual PHP files in the /tmp and /var/tmp paths. Patchstack also identified addresses that can be added to blocklists: 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.
The significance of this development lies in the fact that the window from reconnaissance to active exploitation was approximately one day, making reliance on monitoring alone insufficient for sites that have not confirmed that they are updated. The ability to execute commands remains dependent on specific theme and PHP file conditions and environment settings, but the observed activity proves that the vulnerability is no longer merely a theoretical risk.