Active exploitation begins against critical WordPress template flaw
Threat actors began actively exploiting CVE-2026-87902, a critical WordPress vulnerability rated CVSS 9.2, within hours of its public disclosure. The flaw can allow an unauthenticated attacker to achieve remote code execution when specific server and active-theme conditions are present.
WordPress issued patches on September 22, 2026. The first observed exploitation attempt was recorded at 11:49 a.m. UTC that day, while Previdian recorded 68 exploitation attempts beginning on September 23. The activity shows that attackers moved quickly from disclosure to probing and attempted exploitation.
How the template resolution flaw can lead to code execution
The vulnerability concerns the get_page_template() page-template resolution process. An attacker can cause it to include a selected readable local PHP file located outside the active theme directories. WordPress noted that this can result in remote code execution if the relevant conditions in both the server environment and active theme are satisfied.
Two preconditions are required. The active parent or child theme must contain a top-level directory whose name starts with page-, such as page-templates. A target local PHP file must also be present on the server and readable by the web-server account. WordPress cited pearcmd.php as an example of such a target.
Observed requests write PHP files to temporary directories
Previdian detected malicious requests in its honeypot network originating from 104.194.9[.]227, an address located in New Jersey. The requests sought to include /usr/local/lib/php/pearcmd.php, write a file under /tmp/, and then include an upload script hosted on GitHub.
Patchstack reported a similar progression: requests initially performed reconnaissance against benign WordPress core files, then shifted to including pearcmd.php and using it to write PHP files to disk. Observed activity includes arbitrary file writes containing attacker-controlled PHP in /tmp and /var/tmp.
Reported file names include wp-pear-rce-flag.php, poc87902.php, and files using the prefixes luci_ and zeta_. Some malicious activity also came from an Indonesia-based IP address, alongside the U.S.-based traffic identified by Previdian.
Patch and investigate exposed WordPress systems
Previdian said the flaw is serious but that its preconditions make successful exploitation less likely than scanning volume might suggest. It also expects widespread exploitation attempts because WordPress has automatic updates enabled by default, while anticipating comparatively fewer confirmed compromises.
Administrators should apply WordPress 7.1.2 as soon as possible, or the fixed 7.0.6, 6.9.9, or 6.8.10 releases for the relevant branches. They should also audit servers for unexpected PHP files in temporary directories and investigate requests involving pearcmd.php, because rapid patching and focused review are the immediate business priorities during active exploitation.