Hackers have started actively exploiting a critical WordPress vulnerability that can allow attackers to write malicious files to a server and execute shell commands when those files are accessed.
The activity began with reconnaissance attempts less than five hours after WordPress released version 7.1.2, which contains a fix for the vulnerability. According to WordPress security firm Patchstack, the first malicious requests were detected at 17:44 UTC on September 22, targeting multiple websites from a small number of IP addresses.
The vulnerability, tracked as CVE-2026-87902, was discovered by security researcher Robert Ressl. It is an unauthenticated path traversal flaw that can lead to remote code execution under certain conditions. The WordPress security team has rated it critical with a CVSS score of 9.2 out of 10.
The vulnerability affects the way WordPress handles page-template resolution. An attacker can potentially make the get_page_template() function include a readable local PHP file located outside the active theme directories. However, successful remote code execution requires specific conditions, including an active parent or child theme with a top-level directory beginning with “page-” and a readable local PHP file on the server.
The official advisory also notes that the official PHP Docker image is affected, as is the default cPanel configuration when running a PHP version older than 8.5.
WordPress fixed CVE-2026-87902 in version 7.1.2 and backported the security fix to supported branches as far back as version 4.7 because of the vulnerability’s severity. Versions before 4.6 are not receiving a fix.
Patchstack initially observed attackers attempting to include normal WordPress core files, apparently to identify websites vulnerable to the flaw. The activity has since escalated, with researchers reporting a tenfold increase in related traffic and attempts to write files to disk.
Some attackers are placing simple markers on servers to identify systems vulnerable to CVE-2026-87902, while others are writing PHP files containing code that executes shell commands when accessed. The observed files have been placed in directories such as /tmp and /var/tmp, using filenames including wp-pear-rce-flag.php, poc87902.php, and randomly generated names.
Patchstack has not released a working exploit request, but said the observed attacks use double-encoded traversal sequences in the “pagename” parameter together with a valid “page_id” value.
The security firm identified several IP addresses associated with the observed activity: 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
With active exploitation now underway, WordPress administrators should update their websites to version 7.1.2 as soon as possible and check server logs for signs of suspicious activity.
Hackers Exploit Critical WordPress Flaw for Code Execution
