CVE-2026-87902: 
WordPress vulnerability analysis and mitigation

CVE-2026-87902 is a critical unauthenticated path traversal vulnerability in WordPress Core that allows an attacker to make the get_page_template() function include an arbitrary readable local .php file outside the active theme directories, potentially leading to remote code execution (RCE). It was discovered by Robert Ressl and disclosed on September 22, 2026, affecting WordPress versions 4.7.0 through 7.1.1 across all maintained branches. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4 score of 9.2 (Critical) (GitHub Advisory, CISA KEV).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22) combined with improper control of filename for PHP include/require statements (CWE-98). WordPress's get_page_template() function resolves page templates by constructing a candidate path from the pagename query parameter without adequately sanitizing directory traversal sequences. An attacker supplies a double URL-encoded traversal payload (e.g., templates%252F%252e%252e%252F...) in the pagename parameter alongside a valid page_id; WordPress's sanitizer preserves percent-encoded octets while stripping literal slashes, so the traversal survives sanitization and is decoded by the template loader. Exploitation to RCE requires specific preconditions: the active theme must contain a top-level directory whose name starts with page- (e.g., page-templates), a readable PHP file must exist at a predictable server path, and — for the PEAR-based RCE chain — register_argc_argv must be enabled in PHP and pearcmd.php must be accessible. The official PHP Docker image and default cPanel configurations with PHP < 8.5 are affected by these preconditions (GitHub Advisory, Patchstack).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary PHP files on the server with web server process privileges, resulting in full confidentiality, integrity, and availability compromise of the affected system. At minimum, the vulnerability enables arbitrary file read (information disclosure); under the PEAR gadget chain, attackers can write attacker-controlled PHP files to disk (e.g., /tmp/) and execute arbitrary commands, enabling reverse shells, credential theft, persistent backdoor installation, and lateral movement within the hosting environment. Reports indicate webshells were deployed against hundreds of thousands of sites within days of disclosure (Patchstack, CISA KEV).

CVE-2026-87902 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 25, 2026, with a remediation due date of September 28, 2026 (CISA KEV). Multiple high-confidence public PoC exploits exist on GitHub, including a fully functional Python script demonstrating the two-stage PEAR RCE chain (GitHub PoC). Patchstack observed the first exploitation attempt at 11:49 UTC on September 22, 2026 — the same day the patch was released — with attackers progressing from reconnaissance probing to active PHP file writes within hours; named Nuclei templates and dedicated user agents (cve-2026-87902-poc/1.0, nuclei-cve-2026-87902/1.0) confirm widespread, commoditized exploitation (Patchstack). The EPSS score is approximately 0.198 (19.8%), and the PEAR malware family has been associated with weaponization of this vulnerability. No specific threat actor attribution has been publicly confirmed.

1. Reconnaissance — Identify a valid page ID: Query the unauthenticated WordPress REST API (/wp-json/wp/v2/pages?_fields=id,slug,template) to enumerate published pages and obtain a valid page_id value. This requires no authentication.

2. Verify LFI is active (Stage 1 probe): Send a GET or POST request to /?page_id=<valid_id>&pagename=templates%252Fwp-links-opml (double-encoded traversal). If the response contains WordPress OPML or RSS output instead of a normal page, the host is vulnerable and the inclusion is live.

3. Check for PEAR pearcmd.php (Stage 2 probe): Send GET /?page_id=<valid_id>&pagename=templates%2f<traversal>/usr%2flocal%2flib%2fphp%2fpearcmd&+config-show — trying traversal depths 1–12 and all three common PEAR install paths (/usr/local/lib/php/, /usr/share/php/, /usr/share/pear/). A response containing PEAR configuration output confirms both PEAR availability and that register_argc_argv=On is set.

4. Write malicious PHP to disk (Stage 3 — RCE): Send GET /?page_id=<valid_id>&pagename=templates%2f<traversal>/pearcmd&+config-create+<php_payload>+/tmp/<filename>.php where <php_payload> is a PHP literal (e.g., <?=system($_GET['cmd'])?> encoded via chr() sequences to bypass sanitization). PEAR's config-create command writes the attacker-controlled content to the specified output path.

5. Execute the written PHP file: Send a second request with pagename traversing to the written file (e.g., /tmp/<filename>). WordPress's template loader includes and executes the file, achieving RCE as the web server user.

6. Verify execution: The injected PHP payload executes and returns output in the HTTP response body. The exploit confirms success by searching for a marker string (e.g., CVE-2026-87902-POC-OK) in the response (GitHub PoC, Patchstack).

• Network: HTTP GET or POST requests to site root (/ or /index.php) containing both page_id and pagename parameters simultaneously — this combination is rare in legitimate traffic. Requests with pagename values containing %2e%2e, %252e%252e, %2f, or %252f (encoded traversal sequences). Requests with pagename beginning with templates%2f or other page- directory prefixes. Requests containing pearcmd, +config-show, or +config-create in the query string. User agents cve-2026-87902-poc/1.0 or nuclei-cve-2026-87902/1.0.
• Logs: WordPress access logs showing 200 responses to page URLs that return OPML or RSS content (indicating successful Stage 1 inclusion). POST requests to /index.php with encoded traversal sequences in the body. Repeated requests from the same IP across multiple traversal depths (1–12 levels).
• File System: Unexpected .php files in /tmp or /var/tmp, particularly with names such as wp-pear-rce-flag.php, poc87902.php, luci_<random>.php, or zeta_<random>.php. New PHP files in web-accessible directories not created by WordPress core or plugins.
• Process: Unusual child processes spawned by the web server process (e.g., bash, sh, curl, wget, python) following HTTP requests. Unexpected outbound network connections from the web server process (Patchstack, GitHub Advisory).

Primary remediation: Update WordPress immediately to a patched version. Patches are available for all maintained branches: 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, and 4.7.37 (GitHub Advisory). Workarounds if immediate patching is not possible: (1) Reject requests where pagename contains traversal sequences (%2e%2e, %252e, %2f, %252f) at the WAF or web server level — legitimate slugs never contain these. (2) Disable register_argc_argv in PHP configuration to break the PEAR RCE chain (this does not fix the LFI but prevents code execution). (3) Remove or restrict access to pearcmd.php if PEAR is not required. CISA mandated remediation for federal agencies by September 28, 2026 per BOD 26-04 (CISA KEV). Sites that were exposed before patching should treat historical logs as potentially compromised and conduct forensic triage.

The vulnerability generated immediate and widespread industry attention. Patchstack, which tracked exploitation from the first hours, published detailed threat intelligence reports documenting the rapid escalation from reconnaissance to active RCE within a single day (Patchstack). BleepingComputer, The Hacker News, SecurityWeek, Kaspersky, and CSOOnline all covered the active exploitation, with BleepingComputer reporting hackers began exploiting the flaw within hours of the patch release. CISA issued an alert on September 25, 2026 adding the CVE to the KEV catalog and mandating federal agency remediation within three days — an unusually tight deadline reflecting the severity. The Canadian Centre for Cyber Security (CCCS), Singapore's CSA, New Zealand's NCSC, and Hong Kong's HKCERT all issued independent advisories. Community discussion on Reddit (r/blueteamsec, r/cybersecurity) and Mastodon was active, with security researchers noting the speed of weaponization as particularly alarming. Cloudflare deployed an emergency WAF rule on September 25, 2026 to protect customers.