cyber.hendryadrian.com
Vulnerability & Exploit · fieldeffect.com

WordPress CVE-2026-87902 Exploitation Attempts Begin Within Hours of Patch

· Original article ↗

Summary

Researchers observed reconnaissance and exploitation attempts targeting unauthenticated WordPress path traversal CVE-2026-87902 shortly after the September 22, 2026, release of version 7.1.2. Affected deployments should be updated and investigated.

Key points

  • CVE-2026-87902 is an unauthenticated path traversal flaw affecting WordPress Core 4.7.0 through 7.1.1; it has a CVSS score of 9.2.
  • Researchers saw reconnaissance within hours of the September 22, 2026, update, followed by file-creation attempts by September 23.
  • Exploitation requires a theme with a top-level directory beginning with page- and depends on server-side configuration; authentication and user interaction are not required.
  • Under additional server-side conditions, the vulnerability can enable access to pearcmd.php to create PHP files, potentially leading to remote code execution.
  • Fixed releases include WordPress 7.1.2, 7.0.6, 6.9.9 and 6.8.10, plus corresponding security releases for older supported branches.
  • Review logs for traversal-related requests and references to page-templates or pearcmd.php; monitor web-writable locations for newly created PHP files.
  • If indicators of compromise are found, preserve logs and files, investigate PHP file creation or execution, and review accessible credentials, service accounts and integrations.

Article Details

Vulnerability Types
  • Unauthenticated path traversal
  • Potential remote code execution under required theme and server-side conditions
Severity
CVSS 9.2
Affected Versions
  • WordPress Core 4.7.0 through 7.1.1
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThreat actors made exploitation attempts against internet-facing WordPress sites using CVE-2026-87902.

CVE

CVE-2026-87902Exploitation attempts targeting CVE-2026-87902 began within hours of the September 22 release of WordPress 7.1.2, with activity quickly progressing from reconnaissance to exploitation attempts.

Products

PHPA specially crafted request can cause WordPress to access a readable PHP file located outside the active theme directory.WordPressExploitation attempts targeting CVE-2026-87902 began within hours of the September 22 release of WordPress 7.1.2, with activity quickly progressing from reconnaissance to exploitation attempts.

Related Articles