Ethical Hacking News
A critical security flaw in the widely used web content management system WordPress has been actively exploited by attackers within hours of its public disclosure. This vulnerability, identified as CVE-2026-87902, allows an unauthenticated attacker to obtain remote code execution (RCE) on a WordPress-affected website. The implications for web security are significant, and website administrators are advised to apply WordPress version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10) as soon as possible and audit for signs of malicious activity.
WordPress version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10) must be applied as soon as possible to fix the vulnerability. Experts warn that website administrators must audit for signs of malicious activity to prevent exploitation. Attacks have been recorded from various IP addresses, including Indonesia, and have included malicious requests such as writing a file to "/tmp/" and including a PHP upload script. Preconditions make exploitation less likely, but experts emphasize the importance of timely patching and regular security updates. Patchstack has corroborated findings that attackers are using "pearcmd.php" to write PHP files to disk and exploit the vulnerability.
The cyber security world is abuzz with a new threat that is gaining momentum by the hour. A critical security flaw in the widely used web content management system WordPress, identified as CVE-2026-87902, has been actively exploited by attackers within hours of its public disclosure. This vulnerability, which has a CVSS score of 9.2, allows an unauthenticated attacker to obtain remote code execution (RCE) on a WordPress-affected website.
The vulnerability in question arises from the way WordPress handles page template resolution. According to the advisory released by WordPress, an unauthenticated attacker can include a chosen readable local .php file outside the active theme directories, which can lead to RCE if the preconditions are met. The preconditions for successful exploitation are that the active child or parent theme contains a top-level directory whose name starts with "page-" (e.g., "page-templates"), and a chosen local .php target file exists on the server and is readable by the web server account (e.g., "pearcmd.php").
Experts have warned that website administrators are advised to apply WordPress version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10) as soon as possible and audit for signs of malicious activity. The fact that the vulnerability has been exploited within hours of its disclosure highlights the importance of timely patching and regular security updates.
The exploitation attempts have been recorded from various IP addresses, including 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170, 92.246.130.76, and 104.194.9[.]227. The malicious requests have included the local PHP file "/usr/local/lib/php/pearcmd.php", writing a file to "/tmp/", and then including a PHP upload script hosted on GitHub ("raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php").
Ryan Dewhurst, founder and CEO of Previdian, a WordPress security company, stated that "although this is undoubtedly a serious vulnerability, certain preconditions make exploitation less likely." Dewhurst's organization has recorded a total of 68 exploitation attempts starting September 23, 2026. Some of the efforts have also originated from an Indonesia-based IP address.
Patchstack, another WordPress security company, has also warned that the malicious requests have expanded from reconnaissance against harmless core files to active exploitation in which attackers include "pearcmd.php" and use it to write PHP files to disk, corroborating findings from Previdian.
The first exploitation effort was recorded on September 22, 2026, at 11:49 a.m. UTC, the same day patches were shipped for the flaw. In addition, the activity involves arbitrary file writes with attacker-controlled PHP content in locations like "/tmp" and "/var/tmp." Observed file names include "wp-pear-rce-flag.php", "poc87902.php", "luci_.php", and "zeta_.php".
In light of active exploitation, it is essential for website administrators to prioritize patching and security updates. The fact that attackers are already exploiting this vulnerability highlights the need for vigilance and proactive security measures.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-the-Unpatched-The-Rise-of-Critical-WordPress-Flaw-CVE-2026-87902-and-the-Implications-for-Web-Security-ehn.shtml
https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html
https://nvd.nist.gov/vuln/detail/CVE-2026-87902
https://www.cvedetails.com/cve/CVE-2026-87902/
Published: Thu Sep 24 03:52:06 2026 by llama3.2 3B Q4_K_M
