WordPress CVE-2026-87902 Exploited the Same Day It Was Patched

WordPress shipped a fix for CVE-2026-87902 on September 22, 2026. The first exploitation attempt was recorded at 11:49 a.m. UTC that same day. The flaw carries a CVSS score of 9.2 and allows an unauthenticated attacker to reach remote code execution on sites where two preconditions are met. By September 25, CISA had added it to the Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to patch by September 28.

Auto-updates will close this on most WordPress installs without anyone touching them. The sites that stay exposed are the ones where auto-updates were turned off for change control, stability, or a managed host's own patch cadence. Those are often the business-critical ones.

What the Bug Does

According to the WordPress advisory, an unauthenticated attacker can make get_page_template() resolve a page template to a chosen readable local .php file outside the active theme directories. WordPress then includes that file. Local file inclusion of PHP is code execution if the attacker can find a file that does something useful when included, and PHP ships one.

Exploitation requires both of the following:

• The active child or parent theme contains a top-level directory whose name starts with page- (for example, page-templates). This is a common layout for themes that organize custom page templates.
• A local .php target file exists on the server and is readable by the web server account. The target seen in the wild is pearcmd.php, the PEAR command-line front end.

Observed Attack Chain

Previdian recorded 68 exploitation attempts against its honeypot network starting September 23, with traffic from a New Jersey IP address (104.194.9[.]227) and an Indonesia-based address. The requests follow a three-step pattern:

• Include /usr/local/lib/php/pearcmd.php through the vulnerable template resolution path.
• Use pearcmd.php to write a PHP file into /tmp/.
• Include that file, which pulls a PHP upload script from raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php, giving the attacker a persistent way to upload further payloads.

Patchstack independently saw the same progression: early reconnaissance that included harmless core files to confirm the bug, followed by active exploitation using pearcmd.php to write PHP to disk. Patchstack observed arbitrary file writes with attacker-controlled PHP content in both /tmp and /var/tmp.

Indicators of Compromise

File names observed in /tmp and /var/tmp:

wp-pear-rce-flag.php
poc87902.php
luci_<random>.php
zeta_<random>.php

Source IP addresses linked to exploitation:

104.194.9[.]227
43.250.53[.]42
180.251.159[.]243
195.178.110[.]247
107.189.14[.]87
45.61.184[.]170
92.246.130[.]76

Treat the IP list as short-lived. Mass exploitation campaigns rotate infrastructure quickly. The file names, the pearcmd.php request pattern and PHP files appearing in world-writable temp directories are the durable signals.

How Likely Is Compromise

Previdian founder and CEO Ryan Dewhurst expects mass exploitation attempts but relatively few actual compromises, because WordPress auto-updates are on by default and the preconditions narrow the target set. That assessment is reasonable at internet scale. It does not help an individual organization whose site happens to meet both conditions. A theme with a page-templates directory is routine, and pearcmd.php is present by default on a large share of PHP installs. If auto-updates are disabled on your site, assume you are in the exposed population until you verify otherwise.

What to Do Now

• Update to WordPress 7.1.2, or the fixed release on your branch: 7.0.6, 6.9.9 or 6.8.10.
• Confirm auto-updates for core security releases are enabled, or that your host has applied the update.
• Check whether your active theme and parent theme contain a top-level page-* directory. This tells you whether you met the first precondition.
• Check whether pearcmd.php exists and is readable by the web server user. If PEAR is not used on the web host, remove read access to it or move it out of the PHP include path as defense in depth.
• Search /tmp and /var/tmp for .php files created on or after September 22 and review web server logs for requests referencing pearcmd.
• Look for outbound connections from PHP worker processes to raw.githubusercontent.com. A web server fetching code from GitHub is rarely legitimate.
• If you find a dropped file, treat the host as compromised: rotate WordPress admin, database and API credentials, and check for new admin users and modified plugin or theme files.

Federal agencies have until September 28. Everyone else should be on the same timeline or faster, since the exploit chain is public, simple and already automated.

wp core version --extra

find wp-content/themes -mindepth 2 -maxdepth 2 -type d -name 'page-*'

find / -name pearcmd.php -type f 2>/dev/null; find /tmp /var/tmp -type f -name '*.php' -newermt 2026-09-22 -ls 2>/dev/null

wp core update --minor && wp core version

sudo mkdir -p /root/cve-2026-87902-quarantine && sudo find /tmp /var/tmp -type f -name '*.php' -newermt 2026-09-22 -exec mv -n {} /root/cve-2026-87902-quarantine/ \;

sudo mv /usr/local/lib/php/pearcmd.php /usr/local/lib/php/pearcmd.php.disabled