Do Son 
TL;DR
On September 22, 2026, WordPress addressed a critical security flaw tracked as CVE-2026-87902. Security researchers confirmed that threat actors are actively targeting this critical WordPress RCE vulnerability in the wild. Furthermore, technical details of the vulnerability and working proof-of-concept exploit code have been publicly disclosed.
- CVE: CVE-2026-87902
- CVSS: 8.1 (High · CVSSv3)
- Product: WordPress
- Affected: < 7.1.2
- Impact: CWE-98
- Status: Exploited in the wild
- Patched in: 7.1.2
- EPSS: 0.4% (30-day)
- Action: Update to 7.1.2 now
Track every WordPress CVE the moment it's exploited.
Get free email alertsWhy It Matters
WordPress powers over 43 percent of all websites, representing hundreds of millions of online properties globally. Therefore, security defects in core template processing pose widespread operational risks. Honeypot telemetry confirms active exploitation in the wild. According to a threat intelligence report from Previdian, researchers detected live intrusion traffic. Specifically, Previdian warned, “We’ve started seeing exploitation attempts targeting the recently patched WordPress vulnerability CVE-2026-87902 in Previdian’s honeypot network.”
Sensors recorded 64 attack attempts originating from a single host in New Jersey. The adversary attempted to drop a remote web shell hosted on GitHub. Additionally, public disclosure of the WordPress RCE vulnerability dramatically increases the risk for exposed websites. Security researcher Robert Ressl published a functional exploit in a public GitHub proof-of-concept repository. Consequently, malicious operators can weaponize this issue rapidly against unpatched instances.
How The Attack Works
The vulnerability resides in the core template resolution pipeline. In his detailed technical analysis, researcher Robert Ressl stated, “The core vulnerability is local PHP file inclusion through an unauthenticated frontend request.”
An attacker submits an anonymous HTTP POST request containing public query parameters. The request includes a double-encoded directory traversal string inside the pagename field. Early query sanitization routines preserve these encoded octets. Later, the get_page_template function decodes the path and constructs an invalid template candidate. As Ressl observed, “locate_template() and the final template loader only check existence, readability and the .php/.html suffix never that the canonical path is still inside an allowed theme root.”
On systems with register_argc_argv enabled, attackers chain this inclusion to PEAR components like pearcmd.php. The first request creates a configuration file containing malicious PHP in temporary storage. A secondary request then includes that generated file to execute arbitrary commands as the web server user.
Affected Versions
This flaw impacts WordPress versions 7.1.1 and earlier, spanning all branches down to 4.7. Exploitation requires specific theme and runtime conditions. The active theme must contain a top-level directory starting with page-, such as Twenty Twelve, Twenty Fourteen, Neve, Hestia, or Sydney. Furthermore, runtime environments using the official PHP Docker image or legacy cPanel configurations running PHP versions below 8.5 are directly exposed.
Patch Or Mitigation Steps
Administrators must upgrade their sites to WordPress version 7.1.2 immediately. WordPress core developers also backported the fix to all supported branches down to version 4.7.37. If immediate upgrading is not possible, operators should set register_argc_argv to Off within php.ini files. Furthermore, administrators should remove unused PEAR files and audit themes for top-level page-directories. Applying these defenses eliminates the risk posed by this critical WordPress RCE vulnerability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
