Vulnerabilities · 49 days ago
WordPress attacks now write PHP outside site directories Patchstack says attacks on WordPress CVE-2026-87902 have shifted from reconnaissance to attempts to write and run PHP, with traffic now more than ten times the first evening’s volume.
The flaw lets WordPress load a readable PHP file elsewhere on the server as a page template. Attackers are abusing pearcmd.php, a legitimate PEAR (PHP Extension and Application Repository) package-management tool, to write attacker-controlled PHP under /tmp, then use WordPress to load it. If execution succeeds, attackers can access database credentials and authentication keys, create administrator accounts, or alter site behavior.
This chain depends on a theme with a top-level directory beginning `page-` and PHP settings that make pearcmd.php usable, so not every WordPress site is exposed. Where those conditions hold, files and persistence can extend beyond the WordPress directory, and applying a fix alone does not establish whether a server was already compromised.
NVD KEV
Known exploited · CISA KEV
CVSS 8.1 HIGH: an unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories.
CISA federal remediation date Sep 28
Timeline Sources 8 sources covering this story
CSO Online Sep 24
WordPress patches a critical severity security vulnerability
The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.
SecurityWeek Sep 24
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.
The Hacker News Sep 24
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Attackers are exploiting WordPress CVE-2026-87902 to include pearcmd.php and write PHP files when specific theme and server conditions are met.
BleepingComputer Sep 23
Hackers start exploiting critical WordPress flaw for code execution
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.
NCSC-NL Advisories Sep 23
Kwetsbaarheid verholpen in WordPress Revisies
Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-87902 misbruiken, om zonder authenticatie een lokaal PHP-bestand buiten de actieve themamappen door WordPress te laten inladen.
INCIBE-CERT Sep 23
Inclusión de archivos PHP en WordPress
Robert Ressl ha informado sobre una vulnerabilidad de severidad crítica que, en caso de ser explotada
Help Net Security Sep 23
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) - Help Net Security
WordPress 7.1.2 security release fixes a critical flaw (CVE-2026-87902) letting unauthenticated attackers load local PHP files and run code.
CSIRT Italia / ACN Sep 23
WordPress: PoC pubbliche per lo sfruttamento di nuove vulnerabilità
Disponibili Proof of Concept (PoC) per lo sfruttamento di tre vulnerabilità, già sanate dal vendor, che interessano il prodotto WordPress Core.
The Hacker News Sep 22
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.
Entities Part of the PlainSec briefing for 2026-09-24
Editions Related stories Vulnerabilities · 49 days ago
WordPress attacks now write PHP outside site directories Patchstack says attacks on WordPress CVE-2026-87902 have shifted from reconnaissance to attempts to write and run PHP, with traffic now more than ten times the first evening’s volume.
The flaw lets WordPress load a readable PHP file elsewhere on the server as a page template. Attackers are abusing pearcmd.php, a legitimate PEAR (PHP Extension and Application Repository) package-management tool, to write attacker-controlled PHP under /tmp, then use WordPress to load it. If execution succeeds, attackers can access database credentials and authentication keys, create administrator accounts, or alter site behavior.
This chain depends on a theme with a top-level directory beginning `page-` and PHP settings that make pearcmd.php usable, so not every WordPress site is exposed. Where those conditions hold, files and persistence can extend beyond the WordPress directory, and applying a fix alone does not establish whether a server was already compromised.
NVD KEV
Known exploited · CISA KEV
CVSS 8.1 HIGH: an unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories.
CISA federal remediation date Sep 28
Timeline Sources 8 sources covering this story
CSO Online Sep 24
WordPress patches a critical severity security vulnerability
The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.
SecurityWeek Sep 24
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.
The Hacker News Sep 24
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Attackers are exploiting WordPress CVE-2026-87902 to include pearcmd.php and write PHP files when specific theme and server conditions are met.
BleepingComputer Sep 23
Hackers start exploiting critical WordPress flaw for code execution
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.
NCSC-NL Advisories Sep 23
Kwetsbaarheid verholpen in WordPress Revisies
Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-87902 misbruiken, om zonder authenticatie een lokaal PHP-bestand buiten de actieve themamappen door WordPress te laten inladen.
INCIBE-CERT Sep 23
Inclusión de archivos PHP en WordPress
Robert Ressl ha informado sobre una vulnerabilidad de severidad crítica que, en caso de ser explotada
Help Net Security Sep 23
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) - Help Net Security
WordPress 7.1.2 security release fixes a critical flaw (CVE-2026-87902) letting unauthenticated attackers load local PHP files and run code.
CSIRT Italia / ACN Sep 23
WordPress: PoC pubbliche per lo sfruttamento di nuove vulnerabilità
Disponibili Proof of Concept (PoC) per lo sfruttamento di tre vulnerabilità, già sanate dal vendor, che interessano il prodotto WordPress Core.
The Hacker News Sep 22
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.
Entities Part of the PlainSec briefing for 2026-09-24
Editions Related stories