WordPress Users Warned of Critical Vulnerability Exploits Within Hours of Disclosure
A critical vulnerability in WordPress has been exploited within hours of its public disclosure, leaving thousands of websites potentially compromised. The flaw, tracked as CVE-2026-87902 (CVSS score 9.2), is a path traversal issue that allows unauthenticated attackers to execute remote code on vulnerable servers.
The vulnerability resides in the way WordPress resolves page templates and can be triggered if certain conditions are met, including the presence of specific directory layouts in active themes. According to WordPress’ advisory, themes such as Twenty Twelve and Twenty Fourteen, as well as third-party themes like Neve, Hestia, and Sydney, contain vulnerable directory structures.
Patchstack, a security firm that monitors web application vulnerabilities, was the first to identify exploitation attempts targeting CVE-2026-87902. The firm observed that within hours of public disclosure, attackers began scanning for vulnerable sites, with payloads matching the exact encoding addressed by the patch. This suggests that the attackers were using information from the vulnerability disclosure rather than independently discovering it.
The exploitation activity is believed to originate from a small cluster of IP addresses and has escalated rapidly since its initial detection on September 23. Patchstack notes that traffic against CVE-2026-87902 has increased significantly, with requests moving through three clear stages: verification of server vulnerability, check for PEAR’s pearcmd.php inclusion, and finally, abuse of pearcmd.php to write PHP content and achieve remote code execution.
While the WordPress team had addressed the issue in version 7.1.2 on September 22, backporting fixes to previous releases all the way back to 4.7.x, it is clear that some users have yet to apply the necessary patches. As public scanning tools exist, Patchstack warns of an impending surge in exploitation activity.
The rapid escalation of this vulnerability serves as a stark reminder of the importance of timely patching and vulnerability management for web applications like WordPress. With thousands of websites potentially compromised, it is essential that administrators take immediate action to update their installations and ensure they are not caught off guard by future exploits.
To mitigate potential risks, we strongly advise all WordPress users to:
* Immediately review and apply any available security patches
* Verify the integrity of active themes and plugins
* Regularly monitor server logs for suspicious activity
* Ensure that web servers have the latest PHP versions installed
By taking proactive measures to address this vulnerability, website administrators can prevent potential exploits and protect their online presence from these types of attacks.
Source: SecurityWeek — 2026-09-24