Automated exploitation attempts are sweeping unpatched web servers worldwide as threat actors target a critical WordPress flaw capable of unauthenticated path traversal and arbitrary remote code execution [3]. Telemetry from security researchers revealed that scanning activity began less than five hours after project developers published core maintenance updates, expanding tenfold as adversaries shifted from harmless directory probing toward active payload staging [2]. WordPress released version 7.1.2 yesterday. The defect enables attackers to manipulate internal template resolution routines, forcing underlying servers to include unauthorized files and execute arbitrary commands across exposed environments [3].
Discovery of CVE-2026-87902 and Rapid Exploitation
Security researcher Robert Ressl discovered the underlying vulnerability in WordPress Core with the assistance of artificial intelligence tools, bringing immediate attention to path traversal risks. Ressl uncovered CVE-2026-87902 [1]. Designated as CVE-2026-87902, the unauthenticated flaw allows remote actors to escape intended template directories and read local system files [2]. The WordPress security team assigned the bug a critical severity rating of 9.2 out of 10, whereas the National Vulnerability Database scored the flaw at 8.1 after evaluating attack parameters [3].
Automated exploitation against the critical WordPress flaw began fewer than five hours after developers published core version 7.1.2 on September 22. Threat activity expanded tenfold [3].
Incident telemetry compiled by WordPress security company Patchstack recorded the earliest unauthorized requests at 17:44 UTC on September 22 originating from a small cluster of external IP addresses [3]. In the opening phase, adversaries engaged strictly in reconnaissance against harmless core files to pinpoint unpatched servers without triggering defensive alarms, but that narrow testing window collapsed as public scanning tools circulated across threat forums. When specialized scanning scripts spread, opportunistic operators launched aggressive attempts to plant executable backdoors across unhardened hosting environments [2]. Chris Harper of HotHardware confirmed that client monitoring revealed persistent attack waves pursuing full remote code execution mere hours after the security advisory went live [1].
How Attackers Target the Critical WordPress Flaw
The technical root of the intrusion lies in internal template resolution mechanics within WordPress Core. Official project documentation highlights that get_page_template() resolution allows unauthenticated attackers to include a chosen readable local PHP file located outside active theme directories [2]. Adversaries manipulate template routines by supplying double-encoded directory traversal sequences inside the pagename parameter, combining the malformed string with a valid page ID to bypass basic web server validation filters [3]. Core templates evaluate incoming parameters directly [2].
How do hackers start hacking these vulnerable sites? They initiate attacks by executing automated discovery scripts that systematically probe administrative endpoints and common file paths across thousands of domains simultaneously. Patchstack noted that “when this post first went up, every request we had seen was reconnaissance against harmless core files” before threat groups transitioned toward active staging. Public scanners accelerate automated reconnaissance [2].
Unlike firmware vulnerabilities or device-level bugs like the zero-click modem flaw patched in Google Pixel phones, this campaign exploits standard HTTP application requests without requiring low-level hardware access [2]. Remote threat actors require neither privileged user accounts nor authenticated sessions when transmitting traversal strings against this critical WordPress flaw. Unauthenticated requests reach vulnerable template scripts [3]. A single crafted web request targeting the application layer can initiate file inclusion, exposing internal host resources to unauthorized tampering [2].
System Requirements for Remote Code Execution
Although the critical WordPress flaw exists across unpatched core installations, achieving remote code execution demands a specific set of environmental prerequisites. First, the active parent or child theme must feature a top-level directory whose name begins with page-, such as a custom page-templates folder [2]. Second, threat actors must locate an existing local PHP file that the web server account has permission to read [3]. Chris Harper of HotHardware reported that without these pre-existing system conditions, escalating the exploit beyond local file inclusion remains highly unlikely [1].
The primary exploitation vector observed in the wild relies on the command-line script pearcmd.php. Threat actors target pearcmd.php scripts. When PHP runtime environments enable the register_argc_argv directive, adversaries can pass arguments through URL query strings to manipulate internal PEAR configuration directives [2]. The advisory warns that the official PHP image for Docker and default cPanel configurations remain exposed when running PHP versions released before branch 8.5 [3].
After chaining the path traversal bug with pearcmd.php, attackers alter operational directives to write executable files directly onto host storage. Researchers at Patchstack documented that “the third stage swaps config-show for config-create, which pearcmd will happily use to write a file wherever it is told, with content the attacker controls” [3]. This mechanism transforms what might otherwise remain a restricted local file inclusion bug into a full remote code execution pipeline [2].
Patchstack Tracks Payload Delivery and Host Infrastructure
During active deployment stages, attackers exploiting the critical WordPress flaw drop executable scripts into system staging directories. Adversaries deliver payloads into /tmp. Intrusion files frequently appear in /tmp and /var/tmp under standardized names such as wp-pear-rce-flag.php, poc87902.php, and randomized strings labeled luci or zeta. BleepingComputer reported that while certain payloads merely record verification markers to confirm vulnerability, malicious scripts also “write a short tag that executes a shell command on access” to secure persistent server control [3].
Telemetry analyzed by TechRadar and Patchstack identified early scanning activity originating from six high-volume IP addresses: 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170, and 92.246.130.76 [2]. BleepingComputer designated additional infrastructure for defensive blocklists, specifically flagging 169.58.48.193, 169.58.48.195, and the IPv6 address 2001:df1:e8c0::106b [3]. Patchstack warned that “the first evening came from a small cluster of addresses. It is now spread across a few hundred, so blocklisting individual sources is not a strategy”. Scanning expanded across several hundred endpoints [2].
Telemetry indicates that file write attempts originate from a much tighter subset of addresses than the broad scanning population, illustrating an organized division of labor among malicious operators. A larger scanning network sweeps internet ranges to identify unpatched servers, whereupon specialized staging systems deliver custom PHP payloads. Similar coordinated exploitation patterns emerged during the federal remediation campaign for the Cisco ISE zero-day flaw, where automated scanners mapped target infrastructure prior to payload delivery [2]. Enterprise defense teams must audit web server access logs for anomalous traversal sequences and verify the integrity of temporary file directories [3].
Mitigating the WordPress Security Flaw Across Environments
Applying official security updates represents the primary defense against ongoing attacks targeting this WordPress security flaw [2]. WordPress maintainers patched the vulnerability in version 7.1.2 and backported protective code to historic branches as far back as version 4.7. Releases before 4.6 lack fixes [3]. Chris Harper of HotHardware observed that automated background updates resolved the flaw without manual intervention on personal sites, yet enterprise installations and custom themes often require deliberate administrative testing [1].
For organizations that cannot deploy core updates immediately, security analysts advise implementing edge filtering rules to block incoming directory traversal attempts. Administrators can configure firewalls to reject traversal sequences in the pagename parameter, as legitimate page slugs never contain directory traversal strings during routine operation. Furthermore, disabling PHP’s register_argc_argv directive breaks the command argument chain required by pearcmd, preventing attackers from escalating file inclusion into remote execution. Disabling register_argc_argv neutralizes pearcmd exploitation [2].
Site administrators must actively inspect web server logs for double-encoded traversal attempts and audit /tmp directories for unexpected PHP scripts [3]. Because hundreds of scanning nodes are actively probing web infrastructure, applying the official 7.1.2 update remains the only definitive safeguard against this critical WordPress flaw [2].
- ONLINE NEWS Harper, C. (2026, September 24). Hackers exploit critical WordPress flaw just hours after patch release. HotHardware. [Article Link]
- ONLINE NEWS Fadilpašić, S. (2026, September 24). Hackers are targeting a critical WordPress flaw, so be on your guard. TechRadar. [Article Link]
- ONLINE NEWS Toulas, B. (2026, September 23). Hackers start exploiting critical WordPress flaw for code execution. BleepingComputer. [Article Link]
