WORDPRESS addressed a critical vulnerability, CVE-2026-87902, on 22 September 2026. Rated 8.1 (High) under CVSSv3, the flaw affects versions 7.1.1 and earlier, with a fix available in 7.1.2 and backports reportedly provided down to 4.7.37. Researchers say the vulnerability is being exploited in the wild, while technical details and working proof-of-concept code have also been published publicly.
The flaw is an unauthenticated local PHP file-inclusion issue in WordPress’s template-resolution process. An attacker can send a specially crafted HTTP POST request using double-encoded directory traversal in the `pagename` parameter. Under certain conditions, this can be chained with PEAR’s `pearcmd.php` to create a temporary file containing malicious PHP and then execute commands as the web-server user.
Exploitation depends on factors including the active theme having a top-level directory beginning with `page-`, and `register_argc_argv` being enabled. Previdian reportedly observed 64 attempts from a single New Jersey host against its honeypot network, including an attempt to deploy a web shell hosted on GitHub.
Administrators should upgrade to WordPress 7.1.2 immediately. If that is not possible, the article recommends setting `register_argc_argv` to `Off`, removing unused PEAR files and checking themes for relevant top-level directories. These mitigations address the specific conditions described, but the article identifies updating as the primary response.