WordPress CVE-2026-87902 Hit by Rapid Exploit Waves

Attackers are rapidly exploiting a newly disclosed critical vulnerability in WordPress core, tracked as CVE-2026-87902, with probes and exploit attempts observed within hours of the patch becoming available^[6][10][12]. The flaw allows unauthenticated visitors to steer WordPress into loading unintended PHP files under certain conditions, opening a path to remote code execution and full compromise of affected sites^[1][4][9].

CVE-2026-87902 stems from how WordPress resolves page templates via the get_page_template() function, which can be abused to traverse directories and include readable local PHP files outside the active theme folders^[1][2][14]. Researchers describe it as an unauthenticated path traversal leading to local file inclusion and, on common server and theme configurations, conditional remote code execution^[6][7][10]. Third-party analyses rate the bug at CVSS 9.2 (critical), underscoring both its ease of exploitation and its potential for complete site takeover^[10][12].

The WordPress project released version 7.1.2 on September 22, 2026, as a security update addressing this vulnerability and related issues in core^[3][5][9]. Security advisories and vulnerability databases list WordPress core versions 4.7.0 through 7.1.1 as affected, meaning nearly a decade of releases are exposed if they have not received the backported fix^[4][10][11]. The patch has been rolled out not only in 7.1.2 but also through backports to older branches, including 7.0.6, 6.9.9, 6.8.10 and the long-supported 4.7.x line^[3][4][10].

Within hours of the security release, threat actors began scanning for and targeting unpatched WordPress sites, with telemetry showing active exploitation attempts rather than mere reconnaissance^[6][10][15]. Reports indicate attackers are trying to leverage the path traversal flaw to force inclusion of local PHP files, and in some cases attempting to write files to disk on vulnerable servers^[6][10]. Given the ubiquity of WordPress and the large attack surface across shared hosting environments, defenders should expect opportunistic, mass exploitation rather than highly targeted campaigns^[8][9][13].

Successful exploitation depends on a combination of server and theme preconditions, including the presence of attacker-controllable template paths and readable PHP files that can be reached via traversal outside the theme directory^[1][2][14]. When those conditions are met, WordPress may include and execute code from files the site owner never intended to expose, enabling remote code execution in the context of the web server^[6][9][12]. Advisory authors warn that this can lead to full compromise of the website, theft or manipulation of data, deployment of additional malware and use of the site as a launch pad for further attacks^[6][13][15].

Defenders are urged to immediately verify their installed WordPress version and update to 7.1.2 or the latest security release available on their branch, particularly for installations running any version from 4.7.0 up to 7.1.1^[3][4][15]. Organizations should also review web server logs for suspicious requests targeting page templates, audit the filesystem for unexpected PHP files in non-theme directories, and ensure backups are available in case of compromise^[9][10][13]. Hosting providers and administrators can add an extra layer of protection by enforcing strict file permissions, deploying web application firewalls tuned to block path traversal patterns, and prioritizing patching of high-traffic or business-critical WordPress sites^[6][9][15].

References

1. NVD-CVE-2026-87902 – NIST
2. Unauthenticated path traversal in page-template resolution leading to conditional RCE
3. WordPress 7.1.2 Release
4. CVE-2026-87902 – Vulnerability Details – OpenCVE
5. WordPress 7.1.2 – Actualización de seguridad
6. Critical Vulnerability in WordPress Disclosed (CVE-2026-87902)
7. CVE-2026-87902: WordPress Unauth LFI to RCE – Miggo Security
8. Hackers are targeting a critical WordPress flaw, so be on your guard
9. WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) – Help Net Security
10. CVE-2026-87902: Attackers Started Probing WordPress Sites …
11. CVE-2026-87902: WordPress Core unauthenticated path traversal …
12. CVE-2026-87902: how close is your WordPress to remote code …
13. Security Alert: WordPress Local File Inclusion to Remote Code …
14. WordPress Core Unauthenticated Page-Template Path …
15. Kritiska WordPress ievainojamība CVE-2026-87902 – CERT.LV