WordPress advisory and the vulnerability CVE-2026-87902
WordPress disclosed a critical vulnerability identified as CVE-2026-87902 with a CVSS score of 9.2. The advisory states that the flaw "could allow an unauthenticated attacker to obtain remote code execution (RCE)" by causing get_page_template() to include a readable local .php file outside active theme directories. Patches were shipped the same day the first exploitation effort was recorded, and WordPress advised administrators to apply updates.
Technical preconditions that make exploitation possible
Successful exploitation requires two explicit preconditions noted by WordPress. First, the active child or parent theme must contain a top-level directory whose name starts with page- (for example, page-templates). Second, a chosen local .php target file must exist on the server and be readable by the web server account (the advisory gives pearcmd.php as an example). When both conditions are met, the advisory warns, inclusion can lead to remote code execution.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePrevidian and Patchstack telemetry: early and rapid activity
Security vendor Previdian reported seeing exploitation attempts against its honeypot network, with malicious requests originating from an IP address recorded as 104.194.9[.]227 located in New Jersey. Previdian's telemetry recorded a total of 68 exploitation attempts starting September 23, 2026, and noted that some activity also originated from an Indonesia-based IP address.
Patchstack independently warned that initial malicious requests had shifted from reconnaissance against harmless core files to active exploitation in which attackers include "pearcmd.php" and use it to write PHP files to disk, corroborating Previdian's findings. Previdian recorded the first exploitation effort on September 22, 2026, at 11:49 a.m. UTC — the same day patches were shipped for the flaw.
Observed payloads, attacker behavior, and infrastructure
Previdian observed a repeatable pattern in the malicious requests: attempts to include the local PHP file /usr/local/lib/php/pearcmd.php, write a file into /tmp/ (or similar writable locations), and then include a PHP upload script hosted on GitHub at "raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php". The activity has involved arbitrary file writes containing attacker-controlled PHP content to locations such as "/tmp" and "/var/tmp".
Observed file names dropped by attackers include:
- wp-pear-rce-flag.php
- poc87902.php
- luci_.php
- zeta_.php
Some IP addresses linked to the malicious attacks were published in telemetry and include 43.250.53[.]42, 180.251.159[.]243, 195.178.110[.]247, 107.189.14[.]87, 45.61.184[.]170, and 92.246.130[.]76.
What this means for website administrators, security teams, and adversaries
Website administrators should apply WordPress version 7.1.2 as soon as possible; alternative patched releases listed are 7.0.6, 6.9.9, and 6.8.10. The advisory also recommends auditing sites for signs of malicious activity, given observed arbitrary file writes to /tmp and /var/tmp and the appearance of attacker-controlled PHP files.
Security teams monitoring telemetry will note Previdian's count of 68 exploitation attempts beginning September 23, 2026, and Patchstack's confirmation that activity escalated from reconnaissance to active exploitation that writes files to disk. Teams should prioritize checking for the specific indicators described above — inclusion of pearcmd.php, presence of the observed file names, and inbound requests that reference the GitHub-hosted uploader script.
For adversaries, the public disclosure and the presence of default WordPress auto-updates create a dynamic the advisory and researchers have already observed: "Because WordPress has auto-updates enabled by default, we're likely to see mass-exploitation attempts, but relatively few actual compromises," Previdian founder and CEO Ryan Dewhurst said in a statement shared with The Hacker News.
Active exploitation began within hours of disclosure and has continued across multiple IPs and regions. Administrators are advised to install the patched WordPress releases listed above and to audit writable temporary directories and web-accessible PHP files for the specific indicators identified by Previdian and Patchstack.
Source: https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html
