Active Exploitation of Critical WordPress RCE Vulnerability CVE-2026-87902

What Happened

Malicious actors have begun exploiting CVE-2026-87902, a critical remote code execution vulnerability affecting WordPress core with a CVSS score of 9.2. Honeypot telemetry and threat intelligence observations confirm that exploitation attempts began within hours of the advisory release. The flaw exists in the get_page_template() function, allowing unauthenticated attackers to force page-template resolution to include arbitrary local PHP files outside of active theme directories.

Exploitation Mechanics and Prerequisites

Successful exploitation requires specific environment and theme conditions to be satisfied simultaneously:

• The active parent or child theme contains a top-level directory whose name starts with "page-" (for example, page-templates).
• A target local PHP file exists on the server and is readable by the web server user account, such as pearcmd.php.

Observed attacks involve leveraging local files like /usr/local/lib/php/pearcmd.php to write unauthorized PHP payloads or web shells into temporary directories (/tmp/) or directly onto disk.

Impact and Threat Landscape

Security telemetry has recorded numerous exploitation attempts originating from multiple IP addresses, shifting rapidly from initial reconnaissance to active payload delivery and web shell deployment. While specific environmental preconditions narrow the window of vulnerable targets, default auto-update behaviors in WordPress mitigate some long-term risk. However, legacy installations and custom themes matching the vulnerable profile remain at high risk of full system compromise.

What to Do

Sysadmins and SecOps teams should take immediate action to secure WordPress environments against CVE-2026-87902:

• Update WordPress core immediately to the latest patched version supplied by the vendor.
• Audit active parent and child themes for top-level directories beginning with "page-" that could satisfy the inclusion prerequisite.
• Inspect server environments for unnecessary or publicly accessible local PHP utility files like pearcmd.php.
• Review web server access and error logs for suspicious query parameters involving local file inclusion and unexpected file creation in temporary directories.