CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on September 25, giving federal civilian agencies until September 28 to patch. The flaw sits in WordPress core itself, not a plugin, and carries a CVSS score of 9.2. According to The Hacker News and security firm Patchstack, the first exploitation attempt was logged on September 22 at 11:49 UTC — the same day the fix shipped. Monitoring firm Previdian recorded 68 exploitation attempts starting the following day.
WordPress runs a large share of the public web, and this bug requires nothing from a visitor: no account, no login cookie, no vulnerable plugin. Any unpatched, internet-facing WordPress site running an affected version is a target the moment an attacker's scanner finds it. The one-day gap between patch and mass probing leaves almost no window for administrators who don't update on a schedule.
The bug lives in how WordPress resolves page templates. The core function get_page_template() is supposed to only load PHP files from inside the active theme's directory. Researchers found that a double URL-encoded pagename parameter survives WordPress's sanitization checks and is decoded afterward, letting an attacker traverse outside the theme folder and force the function to include an arbitrary, readable PHP file elsewhere on the server. Exploitation additionally requires the active theme to have a top-level directory whose name starts with "page-", such as page-templates — a common convention, not a rare one.
In the wild, attackers have chained this file inclusion into full code execution using pearcmd.php, a command-line utility bundled with PHP's PEAR package manager, on servers where the register_argc_argv setting is enabled. A first unauthenticated request abuses pearcmd.php's config-create function to write a second, attacker-controlled PHP file into a writable temp directory such as /tmp or /var/tmp. A second request then reuses the same file-inclusion flaw to execute that planted file, handing the attacker code execution under the web server's account. Affected versions run from WordPress 4.7.0 through 7.1.1.
WordPress has shipped fixes in 7.1.2, with backports to 6.9.9, 7.0.6, and 6.8.10. Update immediately — this is not a patch to schedule for the next maintenance window. Administrators who can't update immediately should confirm pearcmd.php is not reachable from the webroot and consider removing or blocking it outright if PEAR isn't in active use, since it has no place being web-accessible on most WordPress installs. Check the active theme for any directory prefixed "page-" as a rough indicator of exposure, and audit /tmp and /var/tmp for unexpected .php files written by the web server user. Web application firewalls should be updated with rules blocking double-encoded traversal sequences in the pagename parameter, and logs should be reviewed back to September 22 for anomalous requests referencing pearcmd or config-create.
