A Critical WordPress Vulnerability Has Been Rapidly Exploited by Hackers After Being Publicly Disclosed
In a disturbing display of speed and determination, hackers have begun exploiting a recently disclosed vulnerability in the popular content management system (CMS) WordPress within hours of its public announcement. The flaw, tracked as CVE-2026-87902 with a CVSS score of 9.2, allows unauthenticated attackers to execute malicious code on vulnerable servers.
The vulnerability is rooted in a path traversal issue affecting WordPress’ page-template resolution. Under specific conditions, hackers can exploit this weakness to execute arbitrary code on the server by including a chosen local PHP file outside the active theme directories. This is made possible if the top-level directory of the active child or parent theme starts with ‘page-‘ and the web server account has read access to a target file on the server.
The exploitation process involves verifying whether the target server is vulnerable, checking for the inclusion of PEAR’s pearcmd.php file, and finally abusing this file to write PHP content that achieves remote code execution (RCE). This method leverages the well-known PEARcmd.php transition, especially when combined with a local file inclusion or path traversal issue.
Several popular themes have been identified as vulnerable, including legacy WordPress themes like Twenty Twelve and Twenty Fourteen, as well as third-party themes such as Neve, Hestia, and Sydney. The security defect has been addressed in the latest version of WordPress (7.1.2), with fixes also backported to previous releases dating back to 4.7.x.
Security firm Patchstack quickly identified the first exploitation attempts targeting CVE-2026-87902 shortly after public disclosure. These initial attacks were designed for reconnaissance but escalated to active compromises by September 23, according to Patchstack. The firm notes that traffic against this vulnerability is now significantly higher than initially observed, with a wider spread of sites targeted and more sophisticated requests.
Given the rapid escalation of exploitation attempts, it’s likely that public scanning tools will contribute to an increase in attacks surrounding CVE-2026-87902. As such, WordPress administrators are urged to apply the latest security updates as soon as possible to mitigate this risk.
In light of this incident, a crucial takeaway for users is the importance of timely software updates and regular monitoring for potential vulnerabilities. Failing to address critical flaws promptly can lead to severe consequences, including data breaches and server compromise. Users should also be aware of the potential for hackers to exploit public disclosure announcements to launch attacks before patches are widely available.
Source: SecurityWeek — 2026-09-24