WordPress Core Vulnerability CVE-2026-87902 Under Active Attack
Critical WordPress Path Traversal Flaw Actively Exploited (CVE-2026-87902)
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
A critical vulnerability has been discovered and is being actively exploited in WordPress Core, the world's most popular content management system. The flaw, identified as CVE-2026-87902, is an unauthenticated path traversal that can lead to local file inclusion (LFI). It affects a vast range of WordPress versions from 4.7.0 to 7.1.1. With a CVSS v4.0 score of 9.2, the vulnerability allows an attacker without any credentials to include and execute arbitrary PHP files on the server, potentially leading to full remote code execution (RCE). Security firms reported that exploitation attempts started almost immediately after public disclosure on September 22, 2026. WordPress has released version 7.1.2 to address the issue, and immediate patching is strongly recommended.
Vulnerability Details
CVE-2026-87902 is a path traversal vulnerability found in the page-template resolution mechanism of WordPress. The core of the issue lies in how WordPress handles the pagename parameter in a request. An unauthenticated attacker can craft a malicious request using double-encoded traversal sequences (e.g., ..%252f) to bypass sanitization checks.
This manipulation tricks the get_page_template() function into resolving a path outside of the intended theme directory. As a result, the attacker can force WordPress to include a readable local PHP file from the server's filesystem. While the immediate impact is Local File Inclusion (T1212 - Exploitation for Client Execution), the severity is amplified because it can be chained to achieve Remote Code Execution (T1203 - Exploitation for Client Execution). RCE is possible if the attacker can find and include a PHP file on the server that contains code useful for further exploitation (a 'gadget'). The public availability of a proof-of-concept (PoC) exploit has lowered the bar for attackers.
Affected Systems
- Product: WordPress Core
- Affected Versions: 4.7.0 through 7.1.1
- Patched Version: 7.1.2 (and backported security releases for older branches)
Any website running an unpatched version of WordPress within this range is vulnerable. Given WordPress's market share, this affects millions of websites globally across all industries.
Exploitation Status
The vulnerability is under active, widespread exploitation. Security company Patchstack confirmed that attacks began within hours of the flaw's public disclosure. The availability of a working PoC means that even low-skilled attackers can attempt to compromise vulnerable sites. The attacks aim to achieve RCE to take full control of the web server, inject malware, steal data, or use the server in a botnet.
Impact Assessment
A successful exploit of CVE-2026-87902 can lead to a full compromise of the web server. An attacker could deface the website, steal sensitive database information (including user data), inject malicious scripts (like credit card skimmers), or use the server to host phishing pages or launch further attacks. For businesses, this translates to significant data breach risks, reputational damage, cleanup costs, and potential regulatory fines. The lack of an authentication requirement makes this flaw exceptionally dangerous and easy to exploit at scale.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
url_patternpagename=..%252fpagename parameter of GET requests in web server access logs.file_path/wp-content/uploads/process_namephp or php-fpmapache2, httpd, nginx) that are executing suspicious commands.log_sourceWeb Server Access Logswp-cron.php or xmlrpc.php containing unusual parameters, as these are common targets for exploit attempts.Detection Methods
- Log Analysis: Scrutinize web server access logs for requests containing the traversal pattern
..%252fin thepagenamequery parameter. Use a SIEM or log analysis tool to search for this string across all web servers. - Vulnerability Scanning: Use a web application scanner or a WordPress-specific security plugin to check if your site is running a vulnerable version.
- File Integrity Monitoring (FIM): Deploy FIM on your web server to detect the creation of new or modified PHP files in unexpected locations, which could indicate a successful compromise and web shell implantation. This aligns with D3FEND's
D3-SFA: System File Analysis.
Remediation Steps
- Update Immediately: The most critical step is to update your WordPress installation to the latest patched version, 7.1.2, or the corresponding security release for your specific branch. This can be done through the WordPress admin dashboard under
Dashboard -> Updates. - Use a Web Application Firewall (WAF): A properly configured WAF can provide a layer of virtual patching by blocking requests that contain malicious path traversal sequences. Many WAF providers have already released rules to protect against CVE-2026-87902.
- Review and Harden: After patching, review your site for any signs of compromise. Check for unauthorized admin users, suspicious files, and unexpected scheduled tasks. Harden your server by disabling unnecessary PHP functions and ensuring correct file permissions.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to update WordPress Core to a patched version immediately.
Mapped D3FEND Techniques:
Exploit Protection
Use a Web Application Firewall (WAF) to filter malicious requests containing path traversal patterns.
Mapped D3FEND Techniques:
Ensure the web server process runs with minimal privileges and cannot write to directories outside of its intended scope.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The most urgent and effective countermeasure for CVE-2026-87902 is to apply the security patches released by WordPress. Administrators must immediately update their sites to WordPress version 7.1.2 or the corresponding patched versions for older supported branches. Given that this is an unauthenticated vulnerability under active, widespread exploitation, patching should be treated as an emergency. Utilize the one-click update feature in the WordPress admin dashboard. For environments with multiple sites, use management tools like WP-CLI (wp core update) to automate the process. After updating, verify the new version is correctly installed. Do not delay this action, as automated scanners are actively seeking and compromising vulnerable sites.
As a critical defense-in-depth measure, especially if patching is delayed, deploy a Web Application Firewall (WAF) with rules specifically designed to block CVE-2026-87902. Most major WAF providers (Cloudflare, Akamai, Sucuri) have already pushed virtual patching rules that inspect inbound HTTP requests for the malicious double-encoded path traversal sequence (..%252f) in the pagename parameter. This filtering will block exploit attempts before they reach the vulnerable WordPress application. Ensure your WAF is in blocking mode, not just logging/alerting. This provides a crucial shield while the underlying software is being patched and can protect against variants of the exploit.
Timeline of Events
CVE-2026-87902 is publicly disclosed, and exploitation attempts begin within hours.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.