Full Report
Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure. The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file
Analysis Summary
# Vulnerability: WordPress Remote Code Execution via get_page_template()
## CVE Details
- **CVE ID:** CVE-2026-87902
- **CVSS Score:** 9.2 (Critical)
- **CWE:** Not explicitly stated (Likely CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program or CWE-22: Path Traversal)
## Affected Systems
- **Products:** WordPress Core
- **Versions:** Versions prior to 7.1.2, 7.0.6, 6.9.9, and 6.8.10.
- **Configurations:** Exploitation requires two specific preconditions:
1. The active child or parent theme must contain a top-level directory starting with `page-` (e.g., `/page-templates/`).
2. A target local `.php` file must exist on the server and be readable by the web server (e.g., `pearcmd.php`).
## Vulnerability Description
The flaw exists within the `get_page_template()` function's page-template resolution logic. An unauthenticated attacker can manipulate this function to include a chosen readable local `.php` file located outside of the active theme directories. If an attacker can include a file like `pearcmd.php` (a common component of the PHP Extension and Application Repository), they can leverage it to write malicious PHP content to the server, leading to Remote Code Execution (RCE).
## Exploitation
- **Status:** Exploited in the wild. Attacks began within hours of the patch release on September 22, 2026.
- **Complexity:** Medium (Requires specific theme directory structures and local file availability).
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full system compromise possible).
- **Integrity:** High (Attacker can write files and execute arbitrary code).
- **Availability:** High (Potential for site takeover or deletion).
## Remediation
### Patches
Update WordPress to the following versions immediately:
- **7.1.2**
- **7.0.6**
- **6.9.9**
- **6.8.10**
### Workarounds
- Ensure WordPress auto-updates are enabled.
- Audit themes to ensure no top-level directories start with `page-` if updates cannot be applied immediately.
- Remove or restrict access to `pearcmd.php` if it is not required by the environment.
## Detection
### Indicators of Compromise (IoCs)
**Observed Attacker IPs:**
- 104.194.9[.]227 (New Jersey, US)
- 43.250.53[.]42
- 180.251.159[.]243
- 195.178.110[.]247
- 107.189.14[.]87
- 45.61.184[.]170
- 92.246.130[.]76
**Malicious Files Created:**
- `wp-pear-rce-flag.php`
- `poc87902.php`
- `luci_.php`
- `zeta_.php`
- Files located in `/tmp/` or `/var/tmp/` containing PHP shell code.
**External Payloads:**
- `raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php`
### Detection Methods
- Monitor web server logs for unusual requests involving `pearcmd.php`.
- Scan filesystem for the specific PHP filenames listed above, especially in temporary directories.
- Check for unauthorized outbound connections to GitHub raw content URLs from the web server.
## References
- **Vendor Advisory:** `https[:]//github[.]com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp`
- **Security Research:** `https[:]//previdian[.]com/CVE-2026-87902#telemetry`
- **Security Research:** `https[:]//patchstack[.]com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/`