Attackers Exploit Critical WordPress Flaw to Write Files That Can Execute Shell Commands
Summary
Attackers have moved from probing CVE-2026-87902 to writing PHP files that can execute shell commands when accessed. WordPress 7.1.2 fixes the flaw; administrators are urged to update and check logs.
Key points
- CVE-2026-87902 is an unauthenticated path traversal flaw that can lead to remote code execution under specific theme and file conditions.
- WordPress security firm Patchstack observed initial reconnaissance less than five hours after the WordPress 7.1.2 patch was released.
- Patchstack later reported a tenfold increase in related traffic, including attempts to write attacker-controlled PHP files to disk.
- Some observed files contain code that executes a shell command when accessed; other payloads only mark a host as exploitable.
- The WordPress security team assigned the flaw a critical severity score of 9.2 out of 10.
- WordPress 7.1.2 fixes the flaw, with fixes backported to branches down to 4.7; versions before 4.6 will not receive a fix.
- Administrators are advised to upgrade, review logs for malicious activity, and block the reported source IPs: 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.
Article Details
- Vulnerability Types
- Unauthenticated path traversal
- Remote code execution
- Severity
- Critical (9.2/10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Block the reported source IP addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 169[.]58[.]48[.]193 | Source IP reported in exploitation activity; administrators were advised to block it. |
| IPV4 | 169[.]58[.]48[.]195 | Source IP reported in exploitation activity; administrators were advised to block it. |
| IPV6 | 2001:df1:e8c0::106b | Source IP reported in exploitation activity; administrators were advised to block it. |
MITRE ATT&CK
T1059.004 · Unix ShellThe reported PHP payloads execute shell commands when accessed.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-87902 on vulnerable WordPress sites exposed to the internet.T1505.003 · Web ShellAttackers wrote PHP files that execute a shell command when accessed.
CVE
People
Products
cPanelThe WordPress advisory notes that the official PHP image for Docker is affected, and so is the default cPanel configuration when a PHP version before 8.5 is used.DockerThe WordPress advisory notes that the official PHP image for Docker is affected, and so is the default cPanel configuration when a PHP version before 8.5 is used.PHPAttackers have shifted from probing CVE-2026-87902 to exploiting it on WordPress sites, using the flaw to write PHP files to disk that can execute shell commands when accessed.WordPressAttackers have shifted from probing CVE-2026-87902 to exploiting it on WordPress sites, using the flaw to write PHP files to disk that can execute shell commands when accessed.