WordPress CVE-2026-87902 Exploitation Shrinks Patch Windows to Hours

What is affected

CVE-2026-87902 is a WordPress core path traversal issue in page-template resolution. Under vulnerable conditions, an unauthenticated request can cause WordPress to include a readable local PHP file outside the active theme directories.¹

Singapore’s Cyber Security Agency said the vulnerability affects WordPress versions before 7.1.2 and can lead to remote code execution when the necessary server and theme conditions are met.²

Those conditions matter. Reported risk factors include parent or child themes whose top-level directory name starts with page-, a readable local PHP target file, and PHP environments where register_argc_argv is enabled, which can enable pearcmd.php abuse in some deployments.¹⁵

SecurityWeek noted examples of theme layouts that may match the relevant pattern, including legacy default themes and some third-party themes. TechRadar highlighted Docker PHP images and cPanel configurations using PHP before 8.5 as environments administrators should scrutinize.¹⁵

Exploitation timeline

The key timeline is compressed:

• September 22, 2026: WordPress released version 7.1.2 and branch fixes for older supported releases.¹⁴
• September 22, 2026, 11:49 a.m. UTC: Telemetry cited by The Hacker News recorded the first exploitation effort.⁴
• Within hours of disclosure: Patchstack observed initial probing, according to SecurityWeek and TechRadar.¹⁵
• September 23, 2026: Activity escalated to active compromise attempts, including pearcmd.php inclusion and PHP writes to temporary directories.¹⁴
• September 24, 2026: Government advisories from Singapore’s CSA and New Zealand’s NCSC urged immediate patching and investigation.²³

The observed payload chain is consistent with fast diff-to-exploit development. SecurityWeek reported Patchstack’s assessment that payloads matched the encoding addressed by the patch, suggesting attackers worked from the public fix rather than rediscovering the flaw independently.¹

Emergency actions for defenders

Teams operating WordPress at scale should move in parallel, not sequence: patch, block likely exploit patterns, and hunt for evidence of compromise.

First, upgrade to WordPress 7.1.2 or the appropriate fixed release for the deployed branch. The Hacker News listed fixed versions including 7.1.2, 7.0.6, 6.9.9, and 6.8.10, and CSA advised affected administrators to update immediately.²⁴ Where automatic updates are enabled, teams should still verify completion across production, staging, abandoned microsites, and customer-managed instances.

Second, apply temporary edge controls for systems that cannot be updated immediately. TechRadar reported interim guidance to reject traversal sequences in the pagename parameter, because legitimate page slugs should not contain them, and to disable register_argc_argv to break the commonly observed pearcmd.php execution chain.⁵ These controls are mitigations, not substitutes for patching.

Third, audit for compromise. The New Zealand NCSC advised immediate upgrade, compromise investigation, theme-path validation, and template-path allow-listing.³ Logs should be reviewed for requests referencing traversal payloads, pearcmd.php, writes to /tmp or /var/tmp, and suspicious PHP filenames. The Hacker News reported observed file names including wp-pear-rce-flag.php, poc87902.php, and randomized luci_ or zeta_ PHP files.⁴

Why blocklists are not enough

Early exploitation reportedly came from a small cluster of IP addresses, but that pattern changed quickly. SecurityWeek said traffic expanded to more than ten times the first evening’s volume and moved through multiple stages, from vulnerability checks to pearcmd.php inclusion and PHP file writes.¹

TechRadar reported that activity spread across hundreds of sources, making individual IP blocklisting an unreliable primary defense.⁵

That escalation pattern is now typical for high-reach web platforms. Once a patch diff, advisory, and proof-of-concept are public, attackers can automate scanning before many organizations finish asset inventory and change approvals. For WordPress, the long tail of themes, hosting panels, PHP versions, and semi-managed sites increases the number of places where a nominally patched platform can remain exposed.

Patch operations need to become platform operations

CVE-2026-87902 underscores that WordPress patching is not just an application-owner task. Web infrastructure teams need controls that assume same-day weaponization: verified auto-updates, external attack-surface discovery, web application firewall rules that can be pushed centrally, and configuration baselines for PHP and hosting environments.

For widely deployed open-source platforms, the operational target should be measured in hours, not weekly maintenance windows. Emergency patching remains the primary fix, but edge filtering, safe defaults, and post-update verification determine whether a fast-moving exploit becomes a limited incident or a broad compromise campaign.