Initial attack traffic started less than five hours after the patch was released in WordPress 7.1.2.
CVE-2026-87902 and WordPress 7.1.2
WordPress addressed a critical vulnerability, tracked as CVE-2026-87902, with the release of version 7.1.2. The WordPress security team assigned the flaw a severity score of 9.2 out of 10 and described the issue in the official advisory: "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories." Fixes have been backported to all branches down to 4.7; releases before 4.6 will not receive a patch.
Patchstack timeline: reconnaissance to live exploitation
WordPress security firm Patchstack observed probing and then active exploitation in rapid succession. The company reported the first malicious requests at 17:44 UTC on September 22 from a small group of IP addresses targeting multiple sites it protects. According to Patchstack, that initial traffic was reconnaissance — attempts to include ordinary WordPress core files to identify vulnerable installations — and arrived less than five hours after WordPress published 7.1.2.
Researchers say that, starting on September 23, the traffic pattern intensified roughly tenfold and moved beyond probing into attempts to write files to disk that can execute shell commands when accessed.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnical requirements that enable remote code execution
The vulnerability is an unauthenticated path traversal bug discovered by security researcher Robert Ressl. WordPress’s advisory lays out the specific conditions under which remote code execution (RCE) is possible:
- The active parent or child theme must have a top-level directory whose name begins with page-, for example page-templates, and an attacker must target a local .PHP file that exists and is readable by the web server.
- The included file must be readable by the web server account. The advisory cites pearcmd.php as an example when PHP’s register_argc_argv setting is active.
The advisory also notes that the official PHP image for Docker is affected and that the default cPanel configuration is affected when a PHP version before 8.5 is used.
Observed payloads, filenames, and indicators of compromise
Patchstack reported a three-stage pattern in the observed activity. In reconnaissance, attackers attempted to include core files; in later stages they combined path traversal with payload delivery. "The third stage swaps config-show for config-create, which pearcmd will happily use to write a file wherever it is told, with content the attacker controls," Patchstack researchers wrote.
The files are written to /tmp and /var/tmp and bear names such as wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php. Some payloads merely write a string to mark the host as exploitable via CVE-2026-87902; others write a short tag that executes a shell command when the file is accessed — a clear indicator of malicious intent.
Patchstack warned that the probes use double-encoded traversal sequences in the pagename parameter alongside a valid page_id. The security firm did not publish a working request example, but it provided network indicators: three source IPs to add to blocklists are 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.
What this means for website administrators, hosting providers, and incident responders
- Website administrators: Update affected sites to WordPress 7.1.2 immediately and review logs for signs of the observed activity — attempts to include local files, double-encoded traversal in pagename requests, and unexpected .php files in /tmp or /var/tmp with names like wp-pear-rce-flag.php or poc87902.php.
- Hosting providers and cPanel operators: Note that default cPanel configurations using PHP versions before 8.5 are affected; review container and image usage where the official PHP Docker image is in play. Implement network-level blocks for the listed IPs where appropriate.
- Incident responders: Treat the presence of short PHP tags that execute shell commands as high priority for containment and forensic collection; attackers have moved from reconnaissance to writability and remote execution in the wild.
The exploit chain documented in public advisories and by Patchstack is concise and fast-moving: a path traversal in get_page_template() plus a writable, readable target file can lead to code execution, and attackers began probing within hours of the patch. For protected sites that have not yet upgraded, that window is closing rapidly.
