Hackers Actively Exploit Critical WordPress Core Flaw, Patch Urged

The flaw is tracked as CVE-2026-87902, an 8.1/10 high-severity unauthenticated path traversal issue discovered by security researcher Robert Ressl. According to WordPress and the National Vulnerability Database, it can lead to local PHP file inclusion and, in certain scenarios, remote code execution. The official advisory said an unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories.

WordPress powers more than half of all active websites, but not all are susceptible to remote code execution. TechRadar said sites are at risk if their parent or child themes have a top-level directory whose name starts with 'page-', such as 'page-templates'. Threat actors must target a local .php file that exists and is readable by the web server, and the web server account must be able to read the included file, for example pearcmd.php if PHP's register_argc_argv setting is active. WordPress said the official PHP image for Docker and the default cPanel configuration are affected, though users must be running a PHP version before 8.5.

The issue was fixed in version 7.1.2, which is available for download, and fixes were backported to older versions up to 4.7. Releases before 4.8 are unsupported and will not receive a fix, according to the advisory. WordPress security company Patchstack said the first exploitation attempts started roughly five hours after the patch was released and were primarily reconnaissance. Malicious activity then increased tenfold as attackers began trying to deliver malicious payloads. 'When this post first went up, every request we had seen was reconnaissance against harmless core files,' Patchstack said. 'That is no longer true. Attackers are now including pearcmd.php and using it to write PHP files to disk, and public scanning tooling for this CVE is in circulation.'

Patchstack initially said attacks came from a handful of IP addresses and advised blocking them, but the activity has become widespread across a few hundred addresses, making individual blocklisting ineffective. TechRadar reported that the busiest addresses at the time included 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170 and 92.246.130.76. File write attempts came from a much smaller subset of those addresses, which Patchstack described as the usual pattern of a few operators acting on results produced by a larger scanning population.

Administrators who cannot update immediately should reject traversal sequences in the pagename parameter, Patchstack added, noting that a real page slug never contains one and that blocking such sequences should not affect normal traffic. Disabling register_argc_argv does not fix the inclusion, but it breaks the pearcmd chain, which Patchstack said is the difference between an information leak and code execution.