WordPress Core Vulnerability CVE-2026-87902 Under Active Attack
Critical WordPress Path Traversal Flaw Actively Exploited (CVE-2026-87902)
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
A critical vulnerability has been discovered and is being actively exploited in WordPress Core, the world's most popular content management system. The flaw, identified as CVE-2026-87902, is an unauthenticated path traversal that can lead to local file inclusion (LFI). It affects a vast range of WordPress versions from 4.7.0 to 7.1.1. With a CVSS v4.0 score of 9.2, the vulnerability allows an attacker without any credentials to include and execute arbitrary PHP files on the server, potentially leading to full remote code execution (RCE). Security firms reported that exploitation attempts started almost immediately after public disclosure on September 22, 2026. WordPress has released version 7.1.2 to address the issue, and immediate patching is strongly recommended.
Vulnerability Details
CVE-2026-87902 is a path traversal vulnerability found in the page-template resolution mechanism of WordPress. The core of the issue lies in how WordPress handles the pagename parameter in a request. An unauthenticated attacker can craft a malicious request using double-encoded traversal sequences (e.g., ..%252f) to bypass sanitization checks.
This manipulation tricks the get_page_template() function into resolving a path outside of the intended theme directory. As a result, the attacker can force WordPress to include a readable local PHP file from the server's filesystem. While the immediate impact is Local File Inclusion (T1212 - Exploitation for Client Execution), the severity is amplified because it can be chained to achieve Remote Code Execution (T1203 - Exploitation for Client Execution). RCE is possible if the attacker can find and include a PHP file on the server that contains code useful for further exploitation (a 'gadget'). The public availability of a proof-of-concept (PoC) exploit has lowered the bar for attackers.
Affected Systems
- Product: WordPress Core
- Affected Versions: 4.7.0 through 7.1.1
- Patched Version: 7.1.2 (and backported security releases for older branches)
Any website running an unpatched version of WordPress within this range is vulnerable. Given WordPress's market share, this affects millions of websites globally across all industries.
Exploitation Status
The vulnerability is under active, widespread exploitation. Security company Patchstack confirmed that attacks began within hours of the flaw's public disclosure. The availability of a working PoC means that even low-skilled attackers can attempt to compromise vulnerable sites. The attacks aim to achieve RCE to take full control of the web server, inject malware, steal data, or use the server in a botnet.
Impact Assessment
A successful exploit of CVE-2026-87902 can lead to a full compromise of the web server. An attacker could deface the website, steal sensitive database information (including user data), inject malicious scripts (like credit card skimmers), or use the server to host phishing pages or launch further attacks. For businesses, this translates to significant data breach risks, reputational damage, cleanup costs, and potential regulatory fines. The lack of an authentication requirement makes this flaw exceptionally dangerous and easy to exploit at scale.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
url_patternpagename=..%252fpagename parameter of GET requests in web server access logs.file_path/wp-content/uploads/process_namephp or php-fpmapache2, httpd, nginx) that are executing suspicious commands.log_sourceWeb Server Access Logswp-cron.php or xmlrpc.php containing unusual parameters, as these are common targets for exploit attempts.Detection Methods
- Log Analysis: Scrutinize web server access logs for requests containing the traversal pattern
..%252fin thepagenamequery parameter. Use a SIEM or log analysis tool to search for this string across all web servers. - Vulnerability Scanning: Use a web application scanner or a WordPress-specific security plugin to check if your site is running a vulnerable version.
- File Integrity Monitoring (FIM): Deploy FIM on your web server to detect the creation of new or modified PHP files in unexpected locations, which could indicate a successful compromise and web shell implantation. This aligns with D3FEND's
D3-SFA: System File Analysis.
Remediation Steps
- Update Immediately: The most critical step is to update your WordPress installation to the latest patched version, 7.1.2, or the corresponding security release for your specific branch. This can be done through the WordPress admin dashboard under
Dashboard -> Updates. - Use a Web Application Firewall (WAF): A properly configured WAF can provide a layer of virtual patching by blocking requests that contain malicious path traversal sequences. Many WAF providers have already released rules to protect against CVE-2026-87902.
- Review and Harden: After patching, review your site for any signs of compromise. Check for unauthorized admin users, suspicious files, and unexpected scheduled tasks. Harden your server by disabling unnecessary PHP functions and ensuring correct file permissions.
Timeline of Events
Article Updates
September 27, 2026
Severity increasedCISA adds CVE-2026-87902 to KEV catalog; exploitation intensifies with specific RCE preconditions and new IOCs identified.
The critical WordPress path traversal flaw, CVE-2026-87902, has been added to CISA's Known Exploited Vulnerabilities catalog, underscoring its severe risk. Exploitation has intensified, with attack volume increasing tenfold within 24 hours of the patch release. New technical details reveal specific preconditions for Remote Code Execution (RCE), including the active theme's directory name starting with 'page-' and the targeting of pearcmd.php for command execution. New indicators of compromise (IOCs) and hunting hints include pearcmd.php as a file name, ?wp_page_template=../../../../ in URL patterns, and include('pearcmd.php') in command lines. Remediation now also includes removing unnecessary pearcmd.php files and hardening permissions.
Update Sources:
Timeline of Events
CVE-2026-87902 is publicly disclosed, and exploitation attempts begin within hours.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.