WordPress attacks now write PHP outside site directories
Patchstack says attacks on WordPress CVE-2026-87902 have shifted from reconnaissance to attempts to write and run PHP, with traffic now more than ten times the first evening’s volume.
The flaw lets WordPress load a readable PHP file elsewhere on the server as a page template. Attackers are abusing pearcmd.php, a legitimate PEAR (PHP Extension and Application Repository) package-management tool, to write attacker-controlled PHP under /tmp, then use WordPress to load it. If execution succeeds, attackers can access database credentials and authentication keys, create administrator accounts, or alter site behavior.
This chain depends on a theme with a top-level directory beginning `page-` and PHP settings that make pearcmd.php usable, so not every WordPress site is exposed. Where those conditions hold, files and persistence can extend beyond the WordPress directory, and applying a fix alone does not establish whether a server was already compromised.
CVSS 8.1 HIGH: an unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories.
WordPress patches a critical severity security vulnerability
The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.