CVE-2026-87902: 
WordPress vulnerability analysis and mitigation

CVE-2026-87902 is a critical unauthenticated path traversal vulnerability in WordPress Core that allows an attacker to make the get_page_template() function include an arbitrary readable local .php file outside the active theme directories, leading to conditional remote code execution (RCE). It was discovered by Robert Ressl and disclosed on September 22, 2026, alongside the release of WordPress 7.1.2. The vulnerability affects WordPress versions 4.7.0 through 7.1.1 across all maintained branches. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4 score of 9.2 (Critical) (GitHub Advisory, CISA KEV).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22) combined with improper control of filename for PHP include/require statements (CWE-98). WordPress's get_page_template() function resolves page templates by constructing a candidate path from the pagename query parameter without adequately restricting traversal sequences. An attacker supplies a double URL-encoded path traversal payload (e.g., templates%252F%252e%252e%252F...) in the pagename parameter alongside a valid page_id; WordPress's slug sanitizer preserves percent-encoded octets while stripping literal slashes, so the traversal survives sanitization and is decoded by the template loader. Exploitation to RCE requires specific preconditions: the active theme must contain a top-level directory whose name starts with page- (e.g., page-templates), a readable target .php file must exist on the server, and for the PEAR-based RCE chain, register_argc_argv must be enabled in PHP and pearcmd.php must be accessible. The official Docker PHP image and default cPanel configurations with PHP < 8.5 are commonly affected (GitHub Advisory, Patchstack).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary PHP files from the local filesystem, resulting in full confidentiality, integrity, and availability compromise of the affected WordPress server. When chained with PEAR's pearcmd.php, attackers can write attacker-controlled PHP files to disk (e.g., /tmp/) and execute arbitrary code as the web server process account, enabling webshell deployment, credential theft, lateral movement within the hosting environment, and persistent backdoor installation. Reports indicate webshells were observed hitting an estimated 350,000 still-exposed sites within days of disclosure (Patchstack, TechTimes).

CVE-2026-87902 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 25, 2026, with a remediation due date of September 28, 2026 (CISA KEV). Multiple high-confidence public PoC exploits are available on GitHub, including a fully functional Python RCE script (cve-2026-87902.py) that automates the two-stage PEAR attack chain (PoC GitHub). Exploitation was first observed at 11:49 UTC on September 22, 2026 — the same day the patch was released — and escalated within 24 hours from reconnaissance probing to active PHP file writes to disk. A named Nuclei template (nuclei-cve-2026-87902/1.0) is in general circulation, indicating mass automated scanning. The EPSS score is approximately 0.198 (19.8%), and CISA's SSVC assessment classifies exploitation as active with total technical impact (Patchstack, Feedly).

1. Reconnaissance — Identify a valid page ID: Query the unauthenticated WordPress REST API (/wp-json/wp/v2/pages?_fields=id,slug,template) to enumerate published pages and obtain a valid page_id value. Without a valid page ID, WordPress returns a 404 and the vulnerable code path is never reached.

2. Probe for vulnerability (Stage 1): Send a GET or POST request with a double-encoded traversal payload targeting a known WordPress core file to confirm the inclusion is live:

GET /?page_id=<valid_id>&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Fwp-links-opml

A response containing OPML or RSS content confirms the host is vulnerable.

3. Check for PEAR pearcmd.php (Stage 2): Probe for PEAR's pearcmd.php at common install paths and verify register_argc_argv is enabled by appending +config-show to the query string:

GET /?page_id=<valid_id>&pagename=templates%2fusr%2flocal%2flib%2fphp%2fpearcmd&+config-show

A PEAR configuration response confirms both PEAR presence and argv injection capability.

4. Write malicious PHP to disk (Stage 3 — RCE): Use pearcmd's config-create command to write attacker-controlled PHP content to a writable path:

GET /?page_id=<valid_id>&pagename=templates%2fpearcmd&+config-create+<php_payload>+/tmp/shell.php

The PHP payload (e.g., <?=system($_GET['cmd'])?>) is encoded using chr() sequences to bypass sanitization.

5. Include and execute the written file (Stage 4): Send a second request using the traversal to include the file written in Stage 3:

POST / with body: page_id=<valid_id>&pagename=<double_encoded_path_to_/tmp/shell.php>

The included PHP executes with web server privileges, confirming RCE.

6. Verify and escalate: Confirm execution by checking the HTTP response for a marker string or command output. From this point, the attacker can deploy a persistent webshell to a web-accessible directory, exfiltrate data, or pivot laterally within the hosting environment (Patchstack, PoC GitHub).

• Network: HTTP GET or POST requests to the WordPress root (/ or /index.php) containing pagename parameter values with %2e%2e, %252e%252e, %2f, or %252f traversal sequences; pagename and page_id parameters appearing together in the same request (rare in legitimate traffic); requests containing pearcmd, +config-show, or +config-create in the query string; user agents cve-2026-87902-poc/1.0 or nuclei-cve-2026-87902/1.0.
• Network (Source IPs observed): 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170, 92.246.130.76 (note: scanning is now distributed across hundreds of IPs).
• Logs: WordPress access logs showing 200 responses to requests with traversal payloads in pagename; OPML or RSS content returned from a non-feed URL (confirms Stage 1 inclusion succeeded); POST requests to / or /index.php with encoded pagename values in the request body.
• File System: Unexpected .php files in /tmp or /var/tmp, particularly with names such as wp-pear-rce-flag.php, poc87902.php, luci_<random>.php, or zeta_<random>.php; new PHP files in web-accessible directories (e.g., /wp-content/uploads/) not created by legitimate WordPress processes.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget); unexpected outbound network connections from the web server process (Patchstack, GitHub Advisory).

The primary remediation is to update WordPress to a patched version. WordPress released fixes across all maintained branches: 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, and 4.7.37 (GitHub Advisory). CISA mandated patching by September 28, 2026 for federal agencies under BOD 26-04 (CISA KEV). If immediate patching is not possible, the following mitigations reduce risk: (1) Deploy WAF rules to reject pagename parameters containing traversal sequences (%2e%2e, %252e%252e) — legitimate slugs never contain these; (2) Disable register_argc_argv in PHP configuration to break the PEAR RCE chain (this does not fix the LFI but prevents code execution); (3) Verify whether the active theme contains a top-level page-* directory and consider renaming it as a temporary measure; (4) Restrict filesystem permissions so the web server process cannot read sensitive PHP files outside the webroot. Sites that were exposed before patching should treat any unexpected .php files in /tmp or /var/tmp as evidence of compromise and conduct forensic triage (Patchstack).

The vulnerability generated immediate and widespread industry attention, with exploitation beginning on the same day as the patch release. Patchstack's security research team published a detailed technical write-up and real-time exploitation tracking report, noting that attackers progressed from reconnaissance to active PHP file writes within 24 hours (Patchstack). BleepingComputer, The Hacker News, SecurityWeek, Kaspersky, and CSO Online all covered the active exploitation, with BleepingComputer reporting that hackers began exploiting the flaw for code execution within hours of disclosure (BleepingComputer). Cloudflare deployed an emergency WAF rule on September 25, 2026 to protect customers. The security community on Reddit (r/blueteamsec, r/cybersecurity) and Mastodon actively discussed detection strategies and the speed of weaponization. CrowdSec published a vulnerability tracking report, and multiple national CERTs (Canada's CCCS, Singapore's CSA, New Zealand's NCSC, Hong Kong's HKCERT) issued advisories urging immediate patching (Canadian Advisory, CISA KEV).