Critical WordPress CVE-2024-XXXX Vulnerability Actively Exploited

Key Takeaways

• A critical unauthenticated local file inclusion vulnerability, CVE-2026-87902, in WordPress Core is under active exploitation.
• The flaw affects WordPress Core versions 4.7.0 through 7.1.1, allowing attackers to write malicious PHP files.
• Initial reconnaissance quickly escalated to attempts at remote code execution, particularly on servers with PEAR installed.
• The vulnerability carries a CVSS score of 9.2 and requires no user interaction or authentication.
• Patches are available in WordPress 7.1.2 and various backported releases; immediate updates are strongly advised.

Critical WordPress Vulnerability Actively Exploited for Remote Code Execution

A severe vulnerability within WordPress Core, identified as CVE-2026-87902, is currently being actively exploited by threat actors. This flaw, initially probed for site reconnaissance, has now progressed to attempts at injecting malicious PHP files onto vulnerable servers, posing a significant risk of remote code execution.

The security loophole impacts WordPress Core versions ranging from 4.7.0 up to and including 7.1.1. A fix has been released in WordPress 7.1.2, alongside backported updates for older, supported branches. According to Patchstack identified, exploit attempts commenced on September 22, mere hours after the security patch was made public.

Escalation from Probing to Malicious File Creation

Early stages of the attack involved reconnaissance, with threat actors sending requests to benign WordPress core files to ascertain site vulnerability. Within 24 hours, this activity evolved, as attackers began targeting the pearcmd.php utility from PEAR to generate PHP files in temporary directories. This method is a known pathway to achieving remote code execution.

CVE-2026-87902 is categorized as an unauthenticated local file inclusion vulnerability, specifically impacting WordPress’s page-template resolution mechanism. It boasts a critical CVSS score of 9.2, highlighting its severity, as it can be exploited without requiring any valid WordPress account credentials or user interaction.

The vulnerability arises from attackers’ ability to manipulate path traversal sequences within the pagename parameter. This manipulation can trick WordPress into loading local PHP files from locations outside the intended template path. The problematic code resides within WordPress’s get_page_template() function.

In affected versions, WordPress performs a URL-decode on a user-controlled page name and then constructs a template candidate. Crucially, it fails to apply the same rigorous path-validation controls that are present elsewhere in the function. This oversight allows a specially crafted request to bypass the theme directory restrictions and include an arbitrary local PHP file.

Remote Code Execution via PEAR Utility

Experts indicate that practical exploitation can escalate to remote code execution when the target server has PEAR installed and the PHP register_argc_argv option is enabled. Attackers are observed probing various common locations for pearcmd.php, including paths typically used by different Linux distributions and container images. Following successful identification, they leverage PEAR’s command handling capabilities to create files containing attacker-controlled content.

Observed malicious payloads have been found writing PHP files to /tmp and /var/tmp directories. These files often bear names such as wp-pear-rce-flag.php, poc87902.php, or feature randomized prefixes like luci_ or zeta_. While files placed in temporary directories may not always be directly accessible via web requests, their successful creation serves as conclusive evidence that attackers have managed to execute their code chain on the server. Organizations should therefore treat any such activity as a potential compromise.

The exploitation campaign has become increasingly sophisticated and widespread. Patchstack identified user agents linked to public proof-of-concept exploits and Nuclei scanning tools, indicating that automated scanning is now being deployed against a vast number of WordPress sites. Threat actors are varying traversal depths, encoding formats, request methods, and URLs, which complicates the development of reliable detection rules based on singular request patterns.

What You Should Do

• Immediate Patching: Update WordPress to version 7.1.2 or the latest patched release for your specific supported branch without delay. Fixed versions include 7.1.2, 7.0.6, 6.9.9, 6.8.10, and backports down to 4.7.37.
• Block Traversal Patterns: Implement web application firewall (WAF) rules or server-level configurations to block path traversal patterns in the pagename parameter.
• Log Inspection: Regularly review server logs for encoded traversal strings and references to pearcmd.
• Monitor Temporary Directories: Inspect /tmp and /var/tmp directories for any unexpected or suspicious PHP files.
• Disable register_argc_argv: While not a complete fix for the underlying vulnerability, disabling PHP’s register_argc_argv option can disrupt the PEAR-based code execution chain.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.