WordPress CVE-2026-87902: template failure allows CERs; patches and mitigation

In the hours following the publication of the official patch, attackers began to actively exploit a critical WordPress vulnerability listed as CVE-2026-87902 (CVSS 9.2). The failure allows an unauthenticated attacker to force the page template resolution function to include a legible local .php file outside the directories of the active subject, and under specific conditions this can result in remote code execution (CERs). WordPress published corrections and recommendations; security companies have subsequently recorded exploitative attempts directed at real sites.

Technically, the problem lies in the way you get _ page _ template () solves template routes: if there is a higher level directory in the active subject (father or child) whose name begins with "page-" (e.g. "page- templates"), the inclusion logic can be manipulated to refer a .php file to any one that is legible on the account of the web server. If the attacker can make that file contain PHP code controlled by him - for example because he previously wrote a file in / tmp or took advantage of a legible file already present in the system - the inclusion causes the execution of that code with the privileges of the web process.

Two pre-conditions are necessary and are confirmed by technical descriptions and telemetry: first, that the active theme has a top-level directory whose name starts by "page-"; second, that there is a .php file readable by the web server user (e.g. / usr / local / lib / php / pearcmd.php) in the system. In several observed attempts the attackers combine both: they use a legible file already present to write a PHP payload in / tmp and then force its inclusion by using the manipulated template route.

Public observations come from security providers who have shared telemetry. Previdian reported 68 attempts at exploitation registered since September 23, 2026 against its honeypots network, with requests that attempted to include / usr / local / lib / php / pearcmd.php and then write files in / tmp containing shells or ascending scripts. Patchstack also confirmed similar activity: the attackers went from polls against harmless core files to including pearcmd.php and perform arbitrary PHP scriptures in temporary server locations. These companies have published analyses and notices that should be consulted for technical details and detection signatures.

Facts confirmed: WordPress published patches for vulnerability and recommended immediate update; security providers have documented active exploitative attempts; attackers have tried to write files in / tmp and / var / tmp with names like wp-pear-rce-flag.php, poc87902.php and luci _ variants.php or zeta _.php; some origins of requests have been identified in public IP ranges.

Estimates and uncertain aspects: We are likely to see extensive automatic sweep and mass of operating attempts - especially because WordPress allows automatic updates by default - but the actual number of sites involved in production and the scope of persistent intrusions is still uncertain. The attack signatures and the vectors observed allow the judge that opportunistic actors automated the exploitation quickly, but there is no public and verifiable evidence of firm attribution or of a large-scale coordinated campaign beyond the initial sweep.

Who does this affect? WordPress sites that run pre-corrected versions and meet pre-conditions (theme with "page-" directory and .php files legible off-topic) are at risk. This includes facilities with additional PHP modules (such as PEAR) that place legible utilities in system locations (/ usr / local / lib / php / pearcmd.php is quoted in multiple reports) and environments in which the web server can read those files. Sites with active automatic updates that applied the patches as soon as they left are less likely to compromise.

The consequences of successful exploitation are serious: an CERs from the web server can allow for backdoors installation, privilege climbing, data exfiltration, site defacement, malicious mail sending, mining or use as a jump platform to other internal assets. Therefore the reaction should be rapid and methodical.

Immediate and concrete actions to be taken by the administrator: apply the official WordPress update to the corrected versions as soon as possible (WordPress 7.1.2, or the branches 7.0.6, 6.9.9, 6.8.10 indicated by the security note). If you cannot update immediately, implement time rules in your WAF to block suspicious parameters and routes, restrict access to time directories (/ tmp, / var / tmp) and block application patterns that try to include files outside / wp-content / themes. Search and remove suspicious temporary files with names observed in attacks (e.g. wp-pear-rce-flag.php, poc87902.php and luci _ / zeta _ variants) in / tmp, / var / tmp and the web root; keep copies for forensic analysis before deleting them if you suspect engagement.

Audit the installation: check the presence of / usr / local / lib / php / pearcmd.php or other PEAR files legible to the web account; check core integrity with tools such as wp-cli (e.g. wp core verify-checksums) and compare with clean copies. Review web access logs to identify requests with template inclusion patterns and PIs listed in the reports; if you find activity, isolate the machine, change affected credentials and key rotée. If there is evidence of remote execution or persistence, restore from clean backups and perform a forensic analysis before reputting the site into production.

Public URLs used to bring remote payloads (e.g. raw.githubusercontent.com /... if it appears on the logs) and enable output controls that prevent the web server from downloading and invoking arbitrary code. Strengthen file permissions and prevent sensitive materials from residing on legible routes on the web server outside the legitimate WordPress tree.

To read official notices and keep up-to-date use the sources of the ecosystem itself: refer to the WordPress security notice in its security category and to the analysis of signatures and mitigation at specialized security sites such as Patchstack and telemetry reports published by companies that monitor the activity. https: / / wordpress.org / news / category / security / and https: / / patchstack.com / blog / They're good starting points. Monitoring publications such as The Hacker News for practical indicators and examples of field exploitation should also be followed: https: / / thehackernews.com /.

In short, vulnerability is real and dangerous, active exploitation has already been documented, and the urgent response must be the updating of the core and a detailed audit of the environment. Updating, auditing and mitigating with filtering / isolation rules are the three priority actions to reduce immediate risk.