Fast Facts
- Threat actors are actively exploiting CVE-2026-87902 in WordPress to achieve remote code execution, including server-side file writes and inclusion of malicious PHP scripts.
- Exploitation requires specific conditions, such as themes with directories starting with "page-" and the presence of readable local PHP files, increasing targeted attack potential.
- Attackers are deploying web shells and writing malicious PHP files in /tmp and /var/tmp, with over 68 attempts observed since the patch release, risking complete website compromise.
Threat Overview, Attack Techniques, and Targets
Threat actors have started exploiting a serious security flaw in WordPress called CVE-2026-87902, quickly after it was made public. This vulnerability is very dangerous, with a high severity score of 9.2. It allows attackers who do not need any login credentials to run malicious code on affected websites.
To exploit this flaw, attackers rely on two main conditions. First, the website must use a theme that has a top-level directory starting with “page-” (for example, “page-templates”). Second, a readable PHP file must exist on the server, such as “pearcmd.php”. If these conditions are met, the attacker can make the website include a local PHP file outside the theme directory, leading to remote code execution.
The attackers are actively scanning websites and trying to exploit this flaw. They are using techniques like sending malicious requests to include “pearcmd.php” and upload PHP scripts to locations like “/tmp”. These scripts can then be used to take control of the website. The IP addresses involved originate from different locations, including the U.S. and Indonesia.
Impact, Security Implications, and Remediation Guidance
The exploitation of CVE-2026-87902 can result in serious consequences. Attackers could run malicious code on the website, modify files, or even take full control of the site. This can affect website integrity, data security, and user trust. Because the vulnerability allows remote code execution, it poses a major security threat.
To reduce these risks, website administrators should update their WordPress installations to the latest versions, specifically version 7.1.2 or higher. They also need to check their websites for signs of malicious activity, such as suspicious files or unusual server behavior.
Since the article does not provide specific remediation steps beyond updating, it is recommended that administrators consult the official WordPress security advisories or their hosting providers for detailed guidance. Implementing strong security measures, monitoring for unusual activity, and applying patches promptly are essential actions to protect WordPress sites from this exploit.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
