Cybersecurity
Attackers exploit WordPress vulnerability within hours
WordPress, Previdian and Patchstack reported exploitation attempts against CVE-2026-87902 soon after disclosure, with some requests using pearcmd.php and writing PHP files to disk under attacker control.
- WordPress said CVE-2026-87902 could let an unauthenticated attacker include a readable local PHP file outside active theme directories and, if conditions were met, reach remote code execution.
- Previdian said it saw attempts against its honeypot network from 104.194.9[.]227 in New Jersey, including use of /usr/local/lib/php/pearcmd.php, writes to /tmp/ and a GitHub-hosted uploader script.
- Ryan Dewhurst said WordPress auto-updates were enabled by default and predicted more mass attempts than full compromises.
- Patchstack said the activity had moved from reconnaissance to exploitation, and WordPress advised installing versions 7.1.2, 7.0.6, 6.9.9 or 6.8.10 and checking for malicious activity.
WordPress said the flaw affected page-template resolution when a site used certain theme directory names and a readable local PHP file was available. Under those conditions, it said the issue could lead to remote code execution.
Previdian said it had seen exploitation attempts in its honeypot network beginning on 23 September 2026. It said telemetry had recorded 68 attempts, and it identified the first as occurring on 22 September 2026 at 11:49 a.m. UTC.
The requests it described used /usr/local/lib/php/pearcmd.php, wrote files into /tmp/ and /var/tmp, and referred to names including wp-pear-rce-flag.php and poc87902.php. Some source IP addresses were also listed, including one geolocated to New Jersey and others said to have come from Indonesia.
Patchstack said the traffic had progressed from checks against harmless core files to exploitation that wrote PHP content to disk. WordPress told administrators to install the corrected releases and review systems for signs of abuse.
Named in this story
People
- Ryan Dewhurst
- Previdian’s founder and chief executive who commented on the likely impact
Companies
- Previdian
- said it saw attempts against its honeypot network
- Patchstack
- said the activity had shifted into active exploitation
- GitHub
- hosted the uploader script used in the requests
Products and systems
- WordPress
- released the advisory and the fixed versions
Places
- New Jersey
- was the reported location of one source IP address
- Indonesia
- was the reported location of some source IP addresses
How the source tells it
The piece was written as a brisk security warning, with urgency coming from the short gap between disclosure and reported exploitation.
- urgency the disclosure-to-exploitation timeline and the call to patch quickly
- alarm the flaw was framed as critical and tied to active exploitation reports
- speculation one vendor executive forecast mass attempts and fewer full compromises