Cybersecurity
Hackers exploit WordPress flaw for code execution
Patchstack said attackers shifted from reconnaissance to file-writing attempts against CVE-2026-87902 after WordPress 7.1.2 shipped, while WordPress described the bug as a path-traversal issue that could lead to remote code execution.
- Patchstack said it first saw malicious requests at 17:44 UTC on 22 September from a small set of IP addresses.
- The company said the activity began as probing, then increased tenfold and moved towards payload delivery.
- WordPress said CVE-2026-87902 was an unauthenticated path-traversal flaw that could become remote code execution under specific conditions.
- WordPress said it released version 7.1.2 on 22 September, backported the fix to branches down to 4.7, and left releases before 4.6 without a patch.
Patchstack said it first detected malicious requests at 17:44 UTC on 22 September, and that they came from a small group of IP addresses. It said the traffic hit several sites it protects and started as reconnaissance.
The company said the attackers first tried to include ordinary WordPress core files to identify exposed sites. It then saw a tenfold rise in related traffic and a later stage that wrote files to disk, with some payloads only leaving a marker and others writing PHP that ran a shell command when opened.
WordPress said CVE-2026-87902 was an unauthorised path-traversal flaw in get_page_template() that could lead to remote code execution if several conditions were present. Those included a theme directory name beginning with page-, a readable local PHP file, and, in one example, pearcmd.php when register_argc_argv was enabled.
WordPress said the issue was fixed in 7.1.2 and that the patch had been backported as far as 4.7. It said versions before 4.6 would not receive a fix, and that the official PHP image for Docker and some cPanel setups using PHP before 8.5 were affected.
Patchstack listed 169.58.48.193, 169.58.48.195 and 2001:df1:e8c0::106b for blocking. It also told administrators to update WordPress and check logs for signs of abuse.
Named in this story
People
- Robert Ressl
- discovered the flaw
Companies
- Patchstack
- observed the attack traffic and reported the exploitation pattern
Organisations
- WordPress security team
- assessed the issue as critical and assigned a 9.2 score
Products and systems
- WordPress
- released version 7.1.2 and backported the fix
- PHP
- had an image and a configuration mentioned as affecting exploitation conditions
- cPanel
- had a default configuration noted as affected before PHP 8.5
- pearcmd.php
- was cited as an example file that could be included under the exploit conditions
How the source tells it
The piece used a cautious incident-response register, with urgency created by the active-exploitation framing and the call to patch immediately.
- urgency active-exploitation language and immediate update advice
- alarm critical severity scoring and malicious-activity framing