Table of contents
17
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: CVE-2026-87902 is a file-inclusion flaw in WordPress core that can turn into remote code execution. It is being exploited, but it only works on sites that meet three conditions at once.
- Nine years of releases are affected. Every WordPress version from 4.7.0 to 7.1.1 is vulnerable. The fix shipped on September 22 in 7.1.2 and in 24 older branches, back to 4.7.37.
- It was attacked within a day. CISA added CVE-2026-87902 to its exploited list on September 25, with a federal deadline of September 28.
- The score depends on who counts. WordPress rates it 9.2 (CVSS 4.0). NVD lists 8.1 (CVSS 3.1). The gap is the conditions.
- Three things must be true. An unpatched core, a theme with a top-level folder named
page-..., and a readable PHP file on the server, such aspearcmd.php, withregister_argc_argvon.- Expect many attempts and few break-ins. Previdian’s founder says the conditions make exploitation less likely. Check yours anyway, because a missing patch is the one condition you control.
Most critical WordPress bugs work on every site. This one works on almost none, and that is exactly why people will get it wrong.
CVE-2026-87902 is a path traversal bug in the way WordPress picks the theme file that renders a page. An attacker can steer that lookup to a .php file somewhere else on the server, and WordPress runs it.
Here is how it works, why the conditions matter, and how to tell in about ten minutes whether your site is one of the few that can be hit.
Here is the description from WordPress’s own advisory, GHSA-7hp8-65ch-5whp:
“An unauthenticated attacker can make
get_page_template()page-template resolution include a chosen readable local.phpfile outside the active theme directories.”
The weakness type is CWE-98, improper control of the filename in an include. The bug was reported by Robert Ressl. The 7.1.2 release post says an attacker can, “under certain conditions,” make WordPress include the file.
Put simply, WordPress builds a list of candidate template names for a page, looks for each one in the theme folder, and loads the first it finds. CVE-2026-87902 lets an attacker put a path in that list that climbs out of the theme folder.
The fix is public, so the cause is readable. The commit is titled “Themes: Restrict path traversal in locate_template()” and landed on September 22, about 40 minutes before the release. It changes two places.
1. A name that was never checked. In get_page_template(), WordPress decodes the page slug and, if the decoded form differs, adds a template named page- plus that decoded text. Before the fix, nothing stopped the decoded text from containing ... The fix adds a validate_file() check.
2. A lookup with no boundary. locate_template() joined the name onto the theme path and loaded whatever existed. The fix adds a new helper, _wp_is_template_path_allowed(), which resolves the real location of the file and refuses anything outside the theme folders.
Together, that is the whole bug: a filename built from the request, no check that it stays inside the theme, and an include at the end.
This is the part that decides whether you are at risk. WordPress’s advisory lists two pre-conditions on top of an unpatched version:
page-. The advisory gives page-templates as an example. It says this affects the legacy Twenty Twelve and Twenty Fourteen themes, and popular third-party themes such as Neve, Hestia and Sydney..php file the attacker can point at. The advisory names the well-known pearcmd.php route, which works when register_argc_argv is on. It says the official PHP image for Docker is affected, and so is the default cPanel setup when PHP is older than 8.5.Why the page- folder? Our reading of the fix is that the vulnerable code builds a name that starts with page-, so the path only resolves if a real folder with that prefix exists for it to climb out of. That is our interpretation, not WordPress’s wording.
The result: an unpatched WordPress site is vulnerable, but code execution needs the theme and the server to line up. That is why the scores differ.
| Source | Score | What it assumes |
|---|---|---|
| WordPress (GHSA) | 9.2, CVSS 4.0 | Network attack, low complexity, “attack requirements present” |
| NVD, entered by CISA-ADP | 8.1, CVSS 3.1 | Attack complexity High, because of the conditions |
Both numbers are right. CISA’s own triage on the NVD record marks exploitation as active, automatable as no, and technical impact as total. “Automatable: no” is the conditions showing up in the data.
The CVE-2026-87902 activity moved fast. Patchstack, as quoted by Help Net Security, said that on the first day every request it saw was reconnaissance against harmless core files. By September 24 that had changed: “Attackers are now including pearcmd.php and using it to write PHP files to disk, and public scanning tooling for this CVE is in circulation.” It added that traffic had grown to more than ten times the first evening’s volume.
The Hacker News reports what Previdian’s honeypots recorded:
pearcmd.php used to write a file into /tmp, followed by loading a PHP uploader script hosted on GitHub./tmp and /var/tmp with names such as wp-pear-rce-flag.php, poc87902.php, luci_<random>.php and zeta_<random>.php.Sources disagree on the exact time of the first attempt. The Hacker News gives 11:49 UTC on September 22, and we could not confirm it independently. We can say exploitation began on the day of the fix.
We do not know who is behind it. CISA lists ransomware use as “Unknown.”
Previdian’s founder, Ryan Dewhurst, put it plainly: “Although this is undoubtedly a serious vulnerability, certain preconditions make exploitation less likely,” and he expects “mass-exploitation attempts, but relatively few actual compromises.”
Work through the conditions in order. You are only open to code execution if all three are true.
1. Are you on a patched version? Fixed releases include 7.1.2, 7.0.6, 6.9.9, 6.8.10 and 6.7.9, with a fix in every branch back to 4.7.37. Check yours:
wp core versionOr open Dashboard, then Updates. WordPress says sites that accept automatic background updates start the update on their own, but this release post does not say updates were forced, so confirm rather than assume.
2. Does your theme have a page- folder? Look at the active theme and its parent:
find wp-content/themes -maxdepth 2 -type d -name 'page-*'A hit in the active theme, or its parent, is condition two. Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney are the ones WordPress names.
3. Is a readable pearcmd.php there, with register_argc_argv on? Search for the file, and check your PHP configuration for the web server, not just the command line, since the two can differ:
find / -name pearcmd.php 2>/dev/nullIf your setup is the official PHP Docker image, or a default cPanel setup with PHP older than 8.5, the advisory says you are affected.
If check two or check three comes back empty, your site is not exploitable through the route the advisory describes, but you should still patch. The conditions protect you today, and one theme change or server upgrade can remove them.
pearcmd.php, and turn register_argc_argv off for the web server. This is our advice, not WordPress’s, and it shrinks the risk without replacing the patch.pearcmd is a sensible stopgap. That is also our advice, and it is a stopgap only.Start where the CVE-2026-87902 attackers wrote. Look for PHP files that should not exist:
/tmp and /var/tmp: new .php files, especially the names above.wp-content: PHP files you did not install, in uploads, plugins or theme folders.pearcmd anywhere in them, from September 22 onward.Then check for the usual next step: new administrator accounts, changed plugins, and outbound connections you cannot explain. Our wp2shell guide has the account and file-integrity commands for that.
CISA’s exploited-list entry is flagged for forensic triage, which means agencies must check for compromise as well as patch. It is a good model for anyone.
Ten weeks ago, CVE-2026-63030 (wp2shell) also put WordPress core on the exploited list. It is worth setting the two side by side.
| wp2shell (CVE-2026-63030) | CVE-2026-87902 | |
|---|---|---|
| Versions | 6.9.0 to 7.0.1 for the full chain | 4.7.0 to 7.1.1 |
| Preconditions | None, on a default install | Theme folder and a readable PHP file |
| Result | Admin account, then a plugin upload | Code execution through an include |
wp2shell was easier to hit and much less forgiving. CVE-2026-87902 reaches far more old sites but needs more luck. Both have the same lesson: the WordPress core is not a safe place to stop looking.
The honest test for CVE-2026-87902 is not “run the exploit.” Public scanning tools exist, and they write files to your server. The useful work is checking the three conditions, and we can do that safely.
We would confirm the version from outside, work out which theme is active and whether it has the folder, review the PHP setup, and search for the file drops above. Then we would check what a compromised WordPress server could reach: the database, the other sites on the same box, the credentials in wp-config.php. That is the kind of testing our human testers and AI agents do on web applications and the servers behind them, and your data stays on your own machine while we do it.
CVE-2026-87902 is a file-inclusion flaw in WordPress core. An unauthenticated attacker can make page-template resolution load a chosen readable .php file from outside the active theme folder, which can lead to remote code execution when the theme and server meet certain conditions.
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on September 25, 2026, and Patchstack and Previdian both report attempts that write PHP files to disk using pearcmd.php.
Every release from 4.7.0 through 7.1.1. WordPress fixed it in 7.1.2 and in 24 older branches, down to 4.7.37.
Every unpatched site has the flaw, but code execution needs two more things: a theme with a top-level folder starting with page-, and a readable .php file such as pearcmd.php with register_argc_argv on.
Update to 7.1.2 or the latest fixed release on your branch, and confirm the version. WordPress documents no workaround. Removing pearcmd.php and turning register_argc_argv off are extra steps we recommend, not replacements for the update.
WordPress rates it 9.2 on CVSS 4.0, while NVD lists 8.1 on CVSS 3.1. The lower score counts the extra conditions as higher attack complexity.
CVE-2026-87902 is a small bug with three moving parts: an unpatched core, a certain kind of theme folder, and a file the server should not have left lying around. Most sites lack at least one of the last two, which is why the honest forecast is many attempts and few compromises.
Do the CVE-2026-87902 update anyway, and do the ten-minute check. If you run the official PHP image, a default cPanel setup or one of the named themes, treat this week as an incident window and look for files that should not be there.
Categories
Related articles
