CVE-2026-87902 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-22

Added to CISA KEV: 2026-09-25 3 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Update all WordPress installations to version 7.1.2 or the latest available patched release for your branch (backports available for all branches back to 4.7). This is the only definitive remediation.
THREAT HUNT — Check for Indicators of Compromise: Review web server access logs for unusual GET/POST requests containing double-encoded path traversal sequences (e.g., %252e%252e%252f patterns) in page-template parameters. Look for requests referencing pearcmd.php or other PHP utility files.
CHECK FOR WEB SHELLS: Audit the WordPress file system for recently created or modified PHP files outside of expected theme/plugin directories. Use file integrity monitoring tools (e.g., Wordfence, iThemes Security) to detect unauthorized file changes.
APPLY WAF RULES: Deploy Web Application Firewall rules to block path traversal patterns in template-related parameters. Wordfence, Cloudflare, and other WAF providers have published rules specifically targeting CVE-2026-87902 exploitation patterns.
REVIEW SERVER CONFIGURATION: Assess whether exploitable PHP utilities (e.g., PEAR's pearcmd.php) are accessible on the server. Remove or restrict access to these files if not required, as their presence is a prerequisite for LFI-to-RCE escalation.
ENABLE AUTO-UPDATES: For sites that cannot be immediately patched manually, ensure WordPress auto-updates are enabled — WordPress 7.1.2 will be pushed as a security auto-update to sites with auto-updates enabled.
MONITOR THREAT INTELLIGENCE: This vulnerability is actively being exploited. Subscribe to Wordfence, WPScan, and CISA advisories for updated IoC feeds and exploitation signatures.
PATCH PRIORITY: CRITICAL — treat as P0. Given confirmed active exploitation, zero-click/zero-auth attack vector, and the massive scale of WordPress deployments, any delay in patching represents an unacceptable risk window.

🔍 Web Intelligence (Kagi · 2026-09-25)

Summary

CVE-2026-87902 is a critical unauthenticated path traversal and local file inclusion (LFI) vulnerability within the WordPress Core component. By exploiting a flaw in the page-template resolution mechanism, specifically through double-encoded path traversal, an unauthenticated attacker can force the server to include and execute arbitrary local PHP files outside of intended theme directories. This is a severe vulnerability because it can lead to remote code execution (RCE) and full site compromise on servers that meet specific configuration conditions.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild, with reports of malicious activity occurring within hours of public disclosure ^[1]^[4].
Threat Actors: Attackers have been observed using this flaw to include files such as `pearcmd.php` to write and execute arbitrary PHP files ^[5].
PoC Availability: Working proof-of-concept (PoC) exploit code is publicly available on platforms like GitHub ^[3].
Attack Prerequisites: The attack is network-exploitable, does not require authentication, and does not require user interaction ^[2]^[7]. Successful execution depends on the specific theme layout and the underlying server environment ^[2].

Affected Products & Patches

Affected Versions: All WordPress Core versions from 4.7.0 through 7.1.1 are vulnerable ^[4]^[8].
Patches: WordPress released security updates in version 7.1.2 to address this vulnerability ^[6].
Mitigations/Workarounds: Users are strongly advised to update to the latest patched version immediately. No specific manual workarounds are recommended over updating the software.

Impact

Access/Capability: Successful exploitation grants an attacker the ability to perform local file inclusion, which can be chained to achieve remote code execution, potentially leading to a complete compromise of the WordPress site ^[2]^[3].
Business Risk: Internet-facing deployments are at extreme risk of unauthorized access, data theft, and site defacement, especially given the active exploitation campaigns currently targeting this vulnerability ^[1].

Sources

Critical WordPress Vulnerability Exploited Immediately ...
Hackers started exploiting CVE-2026-87902, a critical WordPress flaw leading to RCE, within hours of public disclosure.
PSA: Critical Unauthenticated Path Traversal Vulnerability ...
WordPress has released security updates for a critical unauthenticated path traversal vulnerability that can lead to local PHP file ... Conclusion. CVE-2026-87902 is a serious WordPress Core vulnerability because it is reachable without authentication and can cross a theme-directory boundary to incl…
GitHub - rabakuku/CVE-2026-87902-A-working...
CVE-2026-87902 affects WordPress Core versions from 4.7.0 through 7.1.1. It allows an unauthenticated remote attacker to perform path traversal and Local File Inclusion (LFI) via theme template resolution functions (locate_template / get_page_template), which can be chained with environments like pe…
CVE-2026-87902: Critical Vulnerability in WordPress
CVE-2026-87902, a new critical vulnerability in the WordPress core, is already being actively exploited in real-world attacks.WordPress versions affected by CVE-2026-87902. According to data published by WordPress on GitHub, all versions of the CMS from 4.7.0 through 7.1.1 are vulnerable. The compan…
Attackers Exploit WordPress CVE-2026-87902 Within ...
Attackers are exploiting WordPress CVE-2026-87902 to include pearcmd.php and write PHP files when specific theme and server conditions are ...

🔴 CVE-2026-87902