Critical WordPress Vulnerability Exploited Immediately After Disclosure

1. Executive summary

CVE-2026-87902 is a path traversal flaw in WordPress page-template resolution that lets an unauthenticated attacker include a chosen local .php file and, where preconditions are met, reach remote code execution. The verified reference data records CVSS 8.1 HIGH, CWE-98, not listed in CISA KEV, with EPSS at 0%; the source reports a CVSS of 9.2, a discrepancy noted in §3. WordPress fixed the flaw on 22 September 2026 in version 7.1.2 and backported the fix to earlier branches as far back as 4.7.x. Patchstack reports exploitation within hours of disclosure, moving from reconnaissance to active compromise by 23 September, with traffic now more than ten times the first evening's volume. EMEA financial services firms running WordPress for corporate, marketing or customer-facing sites should treat any unpatched instance as exposed and check for compromise, not only patch.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. CVE-2026-87902 is a vulnerability disclosure with no confirmed compromise at any client, and the triggers that would apply (an incident occurred, a third party is involved, patching is required) are true of almost any advisory and do not change what a client must do under a named article.

If a client confirms compromise of an affected WordPress instance, DORA Art. 17 (ICT-related incident management process), Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities) become engaged, and NIS2 Art. 23 (incident reporting obligations) applies to in-scope entities. The classification and reporting clock starts at detection, not at the date of this advisory.

3. Technical analysis & attack chain

The chain below is the confirmed sequence from the WordPress advisory and Patchstack's reporting. Steps 1 to 5 are the exploitation path for CVE-2026-87902; step 6 is reported escalation without published post-exploitation detail for this CVE.

1. Target identification. The attacker scans for WordPress instances running affected versions. No authentication is required and no plugin is needed.
2. Precondition check. The flaw is exploitable only when the top-level directory of the active child or parent theme begins with page-, and when the web server account can read a chosen local .php file that exists on the server.
3. Template resolution abuse. The attacker causes get_page_template() to resolve a page template to a chosen readable local .php file outside the active theme directories. This is the path traversal step.
4. PEAR transition. Where register_argc_argv is set to On, the attacker uses the pearcmd.php PEAR-to-RCE path. The official PHP image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use.
5. Code execution. The attacker abuses pearcmd.php to write PHP content, achieving remote code execution.
6. Escalation. Patchstack reports that initial reconnaissance activity escalated to active compromises by 23 September. The firm does not publish post-exploitation detail for this CVE.

Patchstack describes a three-stage request pattern: first the attacker verifies whether the target server is vulnerable, then checks for PEAR's pearcmd.php inclusion, then abuses pearcmd.php to write PHP content. Initial activity originated from a small cluster of IP addresses. Patchstack states the payloads match the exact encoding the patch addresses, which indicates the tooling was built from the diff rather than from independent discovery. That assessment, and the exploitation timeline, are single-sourced to Patchstack; verify against your own logs before acting on it.

Affected versions run from 4.7.x through 7.1.1, with the fix in 7.1.2 and backports to earlier branches. Themes named as having the directory layout that satisfies the precondition are the legacy Twenty Twelve and Twenty Fourteen themes, plus the third-party themes Neve, Hestia and Sydney.

Two discrepancies with the verified reference data are worth recording. The source quotes CVSS 9.2; the verified value is 8.1 HIGH and is used throughout this advisory. The source describes the flaw as a path traversal; the verified CWE is CWE-98 (improper control of a filename for an include/require statement in a PHP program). Both classifications describe the same mechanism, a traversal that reaches a PHP include.

Related but distinct activity is worth separating out. Reporting from July 2026 covers a different WordPress RCE chain, tracked as CVE-2026-60137 and CVE-2026-63030 and codenamed wp2shell, and a separate plugin flaw, CVE-2026-3300 in Everest Forms Pro. None of those CVEs is CVE-2026-87902, and no verified reference data covers them, so no severity is assigned here. The post-exploitation behaviour reported for the wp2shell campaign is nonetheless a useful template for what follows a WordPress core RCE: watchTowr reported more than 100 backdoor admin accounts created by different actors, deployment of fake WordPress plugins to reach RCE, exfiltration of credentials and secrets, download of additional tooling, and in one case an attempt to pull down Overlord RAT, a Golang remote access trojan. That detail is single-sourced to watchTowr via The Register and should be read as indicative of the class of activity, not as confirmed activity against CVE-2026-87902.

4. Mitigation & containment

P1 (within 24 hours)

• Update WordPress to 7.1.2, or the latest point release on your branch. WordPress enabled forced auto-updates for affected versions; confirm the update actually applied rather than assuming it did.
• If you cannot patch immediately, take affected sites offline or place them behind authentication.
• Set register_argc_argv to Off in php.ini where it is not required. This breaks the pearcmd.php PEAR-to-RCE step.
• Deny HTTP access to pearcmd.php at the web server or WAF.
• Check for compromise: list administrator accounts in wp_users, compare wp-content/plugins against a known-good inventory, and review file integrity across wp-content.

P2 (within 72 hours)

• Audit active themes. Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney are named as having the directory layout that satisfies the precondition. If the top-level directory of the active child or parent theme begins with page-, rename it.
• Upgrade PHP to 8.5 or later on cPanel hosts, where the default configuration is affected on earlier PHP versions.
• Review web server logs for requests to pearcmd.php and for the three-stage request pattern described in §3.
• Rotate WordPress salts, database credentials, and any secrets stored in wp-config.php or readable by the web server account.

P3 (within 7 days)

• Add WAF rules for path traversal in page-template requests.
• Restrict the web server account's read access to .php files outside the web root.
• Confirm backups are clean and restore-tested before relying on them for recovery.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe observable behaviours but publish no atomic indicators such as IP addresses, domains or hashes.

Behavioural indicators

6. Detection

No YARA rule is provided. The sources publish no payload strings, hashes, mutexes or other artefacts of a malicious file, only the abused PEAR path, so a file-scanning rule would have nothing reliable to match on. The Sigma rule below targets the behavioural indicator that is available: HTTP access to pearcmd.php, which is the step the exploitation chain depends on.

title: HTTP Request to pearcmd.php on a WordPress Host
status: experimental
description: Detects HTTP requests to pearcmd.php, the PEAR command-line file abused in the CVE-2026-87902 page-template path traversal chain to write PHP content and reach remote code execution.
references:

  - https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/
author: Adverse Trace
date: 2026/09/24
logsource:
  category: webserver
detection:
  selection_stem:
    cs-uri-stem|endswith: '/pearcmd.php'
  selection_query:
    cs-uri-query|contains: 'pearcmd.php'
  condition: selection_stem or selection_query
falsepositives:

  - Legitimate administrative use of the PEAR command-line tool on an internet-facing host (uncommon)
level: high
tags:

  - attack.initial_access
  - attack.execution

CVE assessment

1 referenced CVE

7. Sources

• SecurityWeek, "Critical WordPress Vulnerability Exploited Immediately After Disclosure", https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/, 2026-09-24
• Dark Reading, "'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover", https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover
• SecurityWeek, "WP2Shell WordPress Vulnerabilities Exploited in the Wild", https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/
• The Hacker News, "WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning", https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html
• BleepingComputer, "Critical Everest Forms Pro flaw exploited to take over WordPress sites", https://www.bleepingcomputer.com/news/security/critical-everest-forms-pro-flaw-exploited-to-take-over-wordpress-sites/
• ANSSI France CERT, "Vulnérabilité dans WordPress", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1018/, 2026-08-13
• The Register, "Attackers pummel critical WordPress vuln to create all sorts of mischief", https://www.theregister.com/security/2026/07/20/attackers-pummel-critical-wordpress-vuln-to-create-all-sorts-of-mischief/5275265, 2026-07-20

8. Adverse Trace position

Adverse Trace assesses CVE-2026-87902 as CVSS 8.1 HIGH per the verified reference data, not listed in CISA KEV, with EPSS at 0%. The EPSS figure sits at odds with the reported exploitation, and we treat it as an artefact of a newly assigned CVE rather than evidence of low risk; the exploitation reporting itself is single-sourced to Patchstack and should be verified against your own logs before enforcement decisions. For EMEA financial services clients, exposure is concentrated in internet-facing WordPress instances used for corporate, marketing or customer-facing sites, where a successful chain gives an unauthenticated attacker code execution and, on the evidence of the related campaign, the ability to create administrator accounts and persist. We will monitor for corroborating vendor reporting and for any CISA KEV addition, and will issue an update if either changes the assessment.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.