--- title: Hackers start exploiting critical WordPress flaw for... description: Attackers have begun actively exploiting CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress that can lead to remote code... canonical: https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers start exploiting critical WordPress flaw for code execution | daily.dev og:description: Attackers have begun actively exploiting CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress that can lead to remote code... og:url: https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt og:image: https://api.daily.dev/og/posts/MNQgiQltt.png og:image:alt: Hackers start exploiting critical WordPress flaw for code execution og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers start exploiting critical WordPress flaw for code execution **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Attackers have begun actively exploiting CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress that can lead to remote code execution under specific theme and PHP configuration conditions. Patchstack observed reconnaissance traffic starting less than five hours after WordPress released the patch in version 7.1.2, with exploitation escalating tenfold as attackers moved from probing to writing malicious PHP files to /tmp and /var/tmp directories that execute shell commands. The flaw scores 9.2/10 in severity, and WordPress has backported fixes down to version 4.7. Site administrators are urged to update immediately and check logs for indicators of compromise, including specific malicious file names and attacker IP addresses. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-87902 in WordPress and how does the exploit work? CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress that allows an attacker to make get_page_template() include a chosen readable local PHP file outside the active theme directories, potentially leading to remote code execution. It requires an active theme with a top-level directory starting with 'page-' and a readable local PHP file such as pearcmd.php with register_argc_argv enabled. It carries a severity score of 9.2 out of 10 and was fixed in WordPress 7.1.2, with backports down to version 4.7. _Teams patching WordPress against active RCE exploits can track vulnerability details like this on daily.dev._ ### How quickly are attackers exploiting the WordPress CVE-2026-87902 vulnerability after the patch was released? Attackers began reconnaissance against WordPress sites vulnerable to CVE-2026-87902 less than five hours after the patch shipped in WordPress 7.1.2. Patchstack first observed malicious requests at 17:44 UTC on September 22 from a small group of IPs, and within a day traffic increased tenfold as attackers moved from probing to actually writing malicious PHP files to disk that execute shell commands. _Security teams racing patch windows against active exploits follow fast-moving vulnerability timelines on daily.dev._ ### What indicators of compromise should I check for after the WordPress pearcmd RCE exploit CVE-2026-87902? Look for malicious PHP files written to /tmp or /var/tmp with names like wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php, which attackers use to write shell-executing tags via pearcmd's config-create option. Also check logs for double-encoded traversal sequences in the 'pagename' parameter alongside a valid 'page_id', and block source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b. _Admins hunting for exploitation artifacts in their own logs rely on concrete IOCs like these via daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers start exploiting critical WordPress flaw for code execution","url":"https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt"},"datePublished":"2026-09-23T18:35:28.996Z","dateModified":"2026-09-23T19:38:22.687Z","description":"Attackers have begun actively exploiting CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress that can lead to remote code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d4581475c94e3e41e39a91bf20402f6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d4581475c94e3e41e39a91bf20402f6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,wordpress","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers start exploiting critical WordPress flaw for code execution"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution-mnqgiqltt#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-87902 in WordPress and how does the exploit work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress that allows an attacker to make get_page_template() include a chosen readable local PHP file outside the active theme directories, potentially leading to remote code execution. It requires an active theme with a top-level directory starting with 'page-' and a readable local PHP file such as pearcmd.php with register_argc_argv enabled. It carries a severity score of 9.2 out of 10 and was fixed in WordPress 7.1.2, with backports down to version 4.7. Teams patching WordPress against active RCE exploits can track vulnerability details like this on daily.dev."}},{"@type":"Question","name":"How quickly are attackers exploiting the WordPress CVE-2026-87902 vulnerability after the patch was released?","acceptedAnswer":{"@type":"Answer","text":"Attackers began reconnaissance against WordPress sites vulnerable to CVE-2026-87902 less than five hours after the patch shipped in WordPress 7.1.2. Patchstack first observed malicious requests at 17:44 UTC on September 22 from a small group of IPs, and within a day traffic increased tenfold as attackers moved from probing to actually writing malicious PHP files to disk that execute shell commands. Security teams racing patch windows against active exploits follow fast-moving vulnerability timelines on daily.dev."}},{"@type":"Question","name":"What indicators of compromise should I check for after the WordPress pearcmd RCE exploit CVE-2026-87902?","acceptedAnswer":{"@type":"Answer","text":"Look for malicious PHP files written to /tmp or /var/tmp with names like wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php, which attackers use to write shell-executing tags via pearcmd's config-create option. Also check logs for double-encoded traversal sequences in the 'pagename' parameter alongside a valid 'page_id', and block source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b. Admins hunting for exploitation artifacts in their own logs rely on concrete IOCs like these via daily.dev."}}]} ```