WordPress CVE-2026-87902 Exploitation: Attackers Writing Malicious Files to Disk

What Happened

After the WordPress 7.1.2 security patch was released, threat actors shifted from probing sites for CVE‑2026‑87902 to actively exploiting the flaw. The first malicious requests appeared at 17:44 UTC on September 22 from a handful of IPs, targeting multiple sites. The attackers now write PHP files to disk that run shell commands when accessed.

Impact

The vulnerability is a path‑traversal bug in the get_page_template() function that lets an unauthenticated user include a chosen readable .php file outside the active theme directory. If the site’s active parent or child theme contains a top‑level directory, the attacker can place a file that executes arbitrary code, giving remote code execution (RCE) with a CVSS score of 9.2.

What to Do

1. Apply the 7.1.2 patch or later immediately. 2. Verify that no unexpected PHP files exist in the root or theme directories. 3. Enable file‑integrity monitoring and alert on new files in the web root. 4. Restrict file‑write permissions for the web server user where possible. 5. Review server logs for suspicious GET requests to /wp-admin or /wp-content.

Detection Tips

Watch for HTTP requests that target wp-admin/admin-ajax.php or wp-content/themes/* with unusual query strings. Look for new files with .php extensions in the site root or theme folders that were not present before the patch. Log file creation timestamps and correlate with access logs to identify potential exploitation.