WordPress shipped an emergency fix on September 22, 2026, for a critical path traversal bug that can hand attackers remote code execution on affected sites. Within hours of that patch landing, researchers were already logging exploitation attempts against unpatched installs, a pattern that has become disturbingly routine for the platform running more websites than any other content management system on earth.
The flaw, tracked as CVE-2026-87902, carries a CVSS score of 9.2, placing it firmly in the critical band. WordPress core maintainers, security firm Patchstack, and outlets including The Hacker News all flagged the bug and its fast-moving aftermath on the same day. Here is what actually happened, what remains unverified, and what site owners need to do before the weekend.
CVE-2026-87902 at a Glance
| Field | Detail |
|---|---|
| Product | WordPress core |
| CVE ID | CVE-2026-87902 |
| CVSS score | 9.2 (Critical) |
| Vulnerability type | Unauthenticated path traversal in get_page_template(), potential RCE |
| Affected versions | WordPress 4.7.0 through 7.1.1 |
| Fixed version | WordPress 7.1.2 (released Sept. 22, 2026) |
| Disclosure date | September 22, 2026 |
| First exploitation attempt observed | September 22, 2026, 11:49 UTC (per Patchstack) |
| Credited discoverer | Robert Ressl |
| CISA KEV catalog status (as of Sept. 22, 2026) | Not listed |
What Happened: WordPress Confirms CVE-2026-87902
WordPress’s security team disclosed CVE-2026-87902 alongside the release of WordPress 7.1.2 on September 22, 2026. The bug sits in get_page_template(), the core function responsible for resolving which template file renders a given page. According to the official WordPress security advisory, “an unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories.”
That single sentence covers a lot of ground. No login is required. The attacker doesn’t need a valid account, an API key, or a session cookie. If the conditions line up, a stranger on the internet can point WordPress’s own template loader at a PHP file it was never meant to touch. The advisory goes further, warning that “if relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE.” Remote code execution is the ceiling outcome for almost any web vulnerability, and it’s rare for a CMS maker to say the word plainly in its own advisory.
The bug was reported by security researcher Robert Ressl, credited by name in the WordPress advisory as the discloser. Credit for a find like this typically comes with a period of coordinated silence between the researcher and the vendor while a patch is built, tested, and staged, which is standard practice across the industry and is why the public only learned about CVE-2026-87902 the same day the fix shipped.
Inside the Vulnerability: How the Path Traversal Flaw Works
Path traversal, also called directory traversal, is a well-documented vulnerability class (OWASP maintains a reference page on the attack pattern) that dates back to the earliest CGI scripts of the 1990s. The idea is simple: an application asks for a file by name, and if it doesn’t sanitize that name carefully, an attacker can substitute a different path and trick the server into reading (or in worse cases, executing) something it shouldn’t. CVE-2026-87902 is a modern, core-level variant of that same old problem, wired into how WordPress decides which template governs a page.
Two specific conditions have to line up for the exploit to work, per the fact pattern confirmed in the advisory. First, the site’s active theme, whether it’s a child theme or the parent, needs a top-level directory whose name starts with page-. That’s a common naming convention for page-template files in WordPress theming, which is exactly why the bug is dangerous: it doesn’t require an obscure or poorly-coded theme, just a fairly ordinary directory structure. Second, the attacker needs to target a local .php file that actually exists on the server and is readable by the account the web server runs under.
Put those two together and you get a scenario where the attacker isn’t uploading anything new. They’re redirecting WordPress’s own template resolution logic to execute a PHP file that’s already sitting somewhere on disk, one that was never supposed to be reachable through the page-template system. That’s what separates this from a garden-variety plugin vulnerability: it lives in a function every WordPress install calls on nearly every page load.
Who’s Affected: Versions 4.7.0 Through 7.1.1
The affected range is unusually wide. WordPress lists every release from 4.7.0 through 7.1.1 as vulnerable, a span that covers roughly a decade of core releases. WordPress 4.7 shipped in December 2016, which means sites running old, unmaintained, or simply neglected installs going back years are theoretically exposed, provided the theme and file-readability conditions line up.
That breadth is what makes core vulnerabilities different from plugin-level ones like the Plugin4Shell bypass reported earlier this year. A plugin flaw only touches the sites that installed that specific plugin. A core flaw touches every WordPress install that hasn’t updated, regardless of what theme or plugin stack sits on top, so long as the two triggering conditions are present.
Not every one of those installs is automatically exploitable. The page- prefixed directory requirement and the readable local PHP file requirement both have to be true, which narrows the practical attack surface. But WordPress theme naming conventions being what they are, security researchers have generally treated that first condition as common enough not to offer much protection on its own.
The Patch: WordPress 7.1.2 Closes the Hole
WordPress 7.1.2, released September 22, 2026, is the fix, and it’s listed on the official WordPress security release blog. Site owners running any affected version should update immediately rather than wait for the next scheduled maintenance window. Most WordPress installs have automatic background updates enabled for minor security releases like this one, which should apply the fix without manual intervention, but that setting can be disabled by hosts, security plugins, or site owners themselves, so it’s worth confirming rather than assuming.
Checking the currently installed version takes seconds from the WordPress dashboard under Updates, or via WP-CLI with wp core version. Anything reporting a version prior to 7.1.2 needs attention now, not after the weekend.
Timeline: From Disclosure to First Exploitation Attempts
Patchstack reported observing the first exploitation attempt against CVE-2026-87902 at 11:49 UTC on September 22, 2026, the same day the patch shipped. Headlines describing the flaw as exploited “within hours of disclosure” are directionally accurate but should be read with some care. Sources agree that malicious activity began on September 22, but they differ on how to characterize it: some framing describes early requests as reconnaissance probes testing whether a target was vulnerable, while other reporting treats the same window as evidence of active, successful exploitation. A single, independently verified time-to-exploit figure hasn’t been established across sources.
What is consistent is the pattern itself, and it’s a familiar one. Critical, unauthenticated, pre-auth vulnerabilities in widely deployed software routinely draw automated scanning within hours of a CVE going public, sometimes faster than defenders can finish rolling out patches across their fleets. That dynamic showed up earlier this year with the Cisco ISE zero-day and the Arista VeloCloud flaw, both of which triggered CISA response windows measured in days, not weeks.
What Attackers Are Actually Doing
According to security researchers tracking the activity, observed requests referenced /usr/local/lib/php/pearcmd.php, a path tied to the PEAR package manager that has shown up in unrelated PHP exploitation chains before. Attackers were reportedly attempting to write attacker-controlled PHP files into temporary directories, including /tmp and /var/tmp, using filenames such as wp-pear-rce-flag.php, poc87902.php, and randomized names following the patterns luci_<random>.php and zeta_<random>.php.
That naming convention is a giveaway of its own. Filenames like poc87902.php look like proof-of-concept scans rather than production malware, the kind of traffic security researchers and automated scanners generate while testing whether a target is reachable and vulnerable, not necessarily traffic from an attacker planning a long-term compromise. The randomized luci_ and zeta_ prefixes are more consistent with automated tooling cycling through payload variations, a common footprint for mass internet scanning rather than a single targeted operator.
GET /wp-admin/admin-ajax.php?...&template=../../../../usr/local/lib/php/pearcmd.php
Observed write targets: /tmp/, /var/tmp/
Observed filenames: wp-pear-rce-flag.php, poc87902.php, luci_<random>.php, zeta_<random>.php
First observed attempt: 2026-09-22 11:49 UTC (per Patchstack)No source in the current record states how many sites were successfully compromised, how many attackers were involved, or how many total malicious requests were logged. Coverage from outlets like BleepingComputer has historically tracked follow-on compromise numbers for CVEs like this one as they firm up in the days after disclosure, but as of this writing no such tally exists for CVE-2026-87902. Anyone citing a specific casualty count for this incident right now is guessing. The honest state of play, as of this writing, is that scanning and early exploitation attempts are confirmed, while the scale of actual compromise is not yet public.
CVSS 9.2 in Context: How Severe Is This, Really
The Common Vulnerability Scoring System runs from 0 to 10, with anything from 9.0 to 10.0 classified as Critical. A 9.2 sits near the top of that band, just shy of a perfect 10, based on the standard scoring rubric documented by the National Vulnerability Database. For comparison, several vulnerabilities that made headlines this year landed even higher: the Cisco ISE bug and the Arista VeloCloud flaw both hit a perfect 10.0, while the recent F5 BIG-IP zero-day scored 9.8.
What pushes a vulnerability toward the top of the scale is usually some combination of three things: no authentication required, low complexity to exploit, and a high-impact outcome like full code execution. CVE-2026-87902 checks all three boxes conditionally, which is why WordPress’s own advisory doesn’t hedge on the RCE potential even while noting the pre-conditions. A 9.2 is not a theoretical, hard-to-weaponize bug. It’s a critical flaw with real conditions attached, and on the open internet, “conditional” rarely means “rare.”
Market and Industry Impact
WordPress’s scale is exactly why a core bug like this draws attention fast. It remains the most widely used content management system on the web by a wide margin, powering everything from personal blogs to enterprise marketing sites and government portals. A vulnerability that touches core template resolution, rather than a single plugin, has a blast radius that scales with that footprint.
Hosting providers and managed WordPress platforms are typically the first line of defense in situations like this, since many push forced updates to customer sites regardless of individual site-owner settings. That buys time for site owners who might otherwise miss the news entirely. Smaller, self-managed installs on generic hosting, the kind that make up a large share of the WordPress ecosystem, carry more of the risk because there’s no intermediary forcing the update.
Security vendors and plugin makers who ship web application firewalls have an incentive to move fast here too. A signature blocking the observed pearcmd.php request pattern is a relatively contained fix to deploy compared to patching every affected install directly, and it’s the kind of stopgap that tends to appear within a day or two of a disclosure like this one.
Historical Context: WordPress’s Long Run With Core Vulnerabilities
WordPress has shipped critical security fixes for core vulnerabilities periodically throughout its history, and the platform’s own update mechanism, introduced years ago specifically to auto-apply minor security releases, exists because of exactly this kind of scenario. What makes CVE-2026-87902 notable within that history isn’t that a core bug exists (that has happened before) but the breadth of the affected range, stretching back to a 2016-era release, combined with the unauthenticated, no-login-required nature of the exploit path.
The broader trend across 2026 has been a steady drumbeat of critical, pre-authentication vulnerabilities across widely deployed infrastructure software, not just WordPress. The VMware vCenter RCE disclosed earlier this year followed a similar shape: a critical score, a scramble to patch, and exploitation attempts that outran patch adoption in the wild. The pattern repeats often enough that security teams increasingly plan for a compressed patch window as the default assumption, not the exception.
Competitive Comparison: How CVE-2026-87902 Stacks Up
Placing CVE-2026-87902 next to other critical vulnerabilities disclosed in 2026 helps calibrate just how serious it is relative to the rest of the year’s infrastructure security news.
| Vulnerability | Product | CVSS Score | Auth Required | Patch Status (as reported) |
|---|---|---|---|---|
| CVE-2026-87902 | WordPress core | 9.2 | No | Fixed in 7.1.2 (Sept. 22, 2026) |
| CVE-2026-76460 | Cisco ISE | 10.0 | No | No workaround at disclosure |
| Arista VeloCloud flaw | Arista VeloCloud | 10.0 | No | CISA set a 3-day fix window |
| CVE-2026-94127 | F5 BIG-IP | 9.8 | No | Patch released |
| CVE-2026-59310 | VMware vCenter | 9.8 | No | Active ransomware exploitation reported |
The pattern across this table is consistent: every one of these bugs is unauthenticated, every one landed in the Critical band, and every one triggered an urgent patch cycle rather than a routine one. WordPress’s entry is the only content management system on the list, sitting alongside network infrastructure and virtualization products, which underscores that CMS software is now held to the same urgency standard as enterprise infrastructure when a core flaw surfaces.
What Site Owners Should Do Right Now
- Confirm your WordPress version. Anything below 7.1.2 needs updating today, not this week.
- Check whether automatic background updates are enabled for your install, and don’t assume they are just because they were at setup.
- If you manage multiple sites or a fleet through WP-CLI, script a version check across all of them rather than relying on the dashboard one site at a time.
- Ask your host directly whether they force-pushed the 7.1.2 update to managed installs, and get it in writing if the answer matters for compliance reporting.
- Review server logs for requests referencing
pearcmd.phpor unfamiliar.phpfiles recently written to/tmpor/var/tmp. - If your site runs an older, custom, or abandoned theme, check whether it includes a directory starting with
page-, since that’s one of the two conditions the exploit depends on. - Don’t wait on a plugin-level web application firewall alone. Signature-based blocking helps, but the actual fix is the version upgrade.
Predictions: What Happens Next
A handful of trends seem likely to play out over the coming weeks, based on how comparable disclosures have unfolded earlier this year.
Expect automated scanning for the flaw to continue rising for several more days before it plateaus, as botnets and opportunistic scanners fold the CVE-2026-87902 signature into their standard scan lists. That’s the normal curve for any unauthenticated, high-severity web vulnerability once proof-of-concept traffic starts circulating publicly.
Managed WordPress hosts will likely publicize their forced-update response as a selling point, using the incident to reinforce the value proposition of managed hosting over self-managed installs. That’s a predictable marketing beat that follows nearly every major WordPress core disclosure.
Security plugin vendors will roll out virtual patches and firewall rules targeting the observed pearcmd.php request pattern within days, giving site owners who can’t immediately update a partial stopgap. That won’t replace the real fix, but it will show up in changelogs fast.
Given the wide affected range going back to 2016-era releases, expect a long tail of outdated, abandoned WordPress installs to remain exploitable for months or years, the same way older core and plugin vulnerabilities keep turning up in breach reports long after a patch exists. That tail is less about this specific CVE and more about how much unmaintained WordPress infrastructure sits on the open internet at any given time.
Whether this specific incident earns a CISA Known Exploited Vulnerabilities catalog entry remains an open question. As of September 22, 2026, it had not been added, and that decision typically follows confirmed evidence of active exploitation in the wild rather than early scanning activity alone.
How This Compares to Recent WordPress Ecosystem Threats
CVE-2026-87902 isn’t the first time the WordPress ecosystem made security news this year. Chinese state-linked hacking activity tied to WordPress sites and networking gear was reported earlier in 2026, though that campaign centered on different infrastructure and a different attack chain entirely. The common thread across both stories is the same one that runs through most WordPress security news: the platform’s sheer scale means any exploitable weakness, whether in core, a popular plugin, or adjacent infrastructure, gets tested by attackers almost immediately once it becomes public.
That’s also why patch cadence and disclosure timing matter so much in stories like this one. A vulnerability that sits privately reported for weeks while a fix is built and tested, then drops publicly the same day the patch ships, is the industry-standard approach to minimizing the window attackers get to work with. It doesn’t eliminate the risk (as the September 22 exploitation attempts show), but it narrows it considerably compared to disclosing a flaw with no fix available.
Frequently Asked Questions
What is CVE-2026-87902?
It’s a critical, unauthenticated path traversal vulnerability in WordPress core, specifically in the get_page_template() function, that can lead to remote code execution under certain conditions. It carries a CVSS score of 9.2.
Which WordPress versions are affected?
WordPress versions 4.7.0 through 7.1.1 are listed as affected. WordPress 7.1.2, released September 22, 2026, contains the fix.
How do I know if my site is vulnerable?
Check your installed WordPress version from the dashboard or with wp core version via WP-CLI. If it’s below 7.1.2, update immediately. The exploit also requires your active theme to have a directory starting with page- and a readable local PHP file for the attacker to target, so not every outdated install is automatically compromised, but every outdated install should still be patched.
Has CVE-2026-87902 been added to the CISA Known Exploited Vulnerabilities catalog?
As of September 22, 2026, it had not been added to CISA’s KEV catalog, according to available records.
Was this really exploited within hours of disclosure?
Patchstack logged the first exploitation attempt at 11:49 UTC on September 22, 2026, the same day the patch shipped. Sources differ on whether that early activity represents reconnaissance scanning or successful exploitation, so treat the “within hours” framing as directionally true rather than a precisely confirmed figure.
Do I need to do anything beyond updating WordPress core?
Updating to 7.1.2 addresses the root cause. Reviewing server logs for suspicious pearcmd.php requests or unexpected PHP files in temporary directories is a reasonable follow-up step if your site was running an affected version before you patched.
Who discovered the vulnerability?
WordPress credited security researcher Robert Ressl with reporting CVE-2026-87902 in its official advisory.
How does this compare to other 2026 zero-days like the Cisco ISE or F5 BIG-IP flaws?
All of them are unauthenticated, Critical-band vulnerabilities in widely deployed software. CVE-2026-87902’s 9.2 score sits slightly below the perfect 10.0 scores logged for the Cisco ISE and Arista VeloCloud flaws, and just under the 9.8 scores for the F5 BIG-IP and VMware vCenter bugs, but all five triggered urgent, same-week patch cycles rather than routine ones.
