Security1 publisher2 min readPublished
Exploit attempts for WordPress CVE-2026-87902 began the same day its patch shipped
The flaw reaches code execution only where the active theme has a top-level directory starting with page- and a readable local .php file such as pearcmd.php sits on the server. Previdian has logged 68 attempts.
The Watch · Security desk
What happened
- WordPress disclosed CVE-2026-87902, rated CVSS 9.2, which lets an unauthenticated attacker reach remote code execution through page-template resolution.
- The first exploitation attempt on record was logged at 11:49 a.m. UTC on September 22, 2026, the same day WordPress shipped patches for the flaw.
- Patchstack reports that requests have moved from reconnaissance against harmless core files to including pearcmd.php and writing PHP files to disk, matching what Previdian saw.
- Previdian's telemetry counted 68 exploitation attempts starting September 23, with traffic from a New Jersey address and from an Indonesia-based IP.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Version number alone does not tell an operator whether a site is reachable. The theme directory name and the web server account's read access to local .php files decide it.
- constraint Auto-updates on by default shrink the vulnerable set to installs that never took the update. Those are the only hosts where a compromise can land.
- decision Operators who cannot update a host today have a second lever: break one precondition instead of waiting on a maintenance window.
- precedent A core WordPress advisory was weaponised inside a day, so the next one should be planned for as same-day work, not a scheduled patch cycle.
Two conditions decide whether a host is exploitable. The active child or parent theme has to contain a top-level directory whose name starts with page-, such as page-templates [3]. A local .php file the attacker names has to exist on disk and be readable by the web server account [4]. WordPress described the primitive in its advisory: "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories" [2]. Both conditions are checkable in one shell session.
The file attackers are naming is /usr/local/lib/php/pearcmd.php. Previdian's honeypots logged requests that include it, write a file into /tmp/, then include a PHP uploader hosted on raw.githubusercontent.com [7]. The writes land in /tmp and /var/tmp with attacker-controlled PHP content, under names including wp-pear-rce-flag.php, poc87902.php, and luci_ and zeta_ names with random suffixes [9].
The volume is scanner volume. Previdian's count of 68 starts on September 23, a day after the earliest attempt on record, so it excludes the first day of activity [1]. Between the two write-ups, seven source addresses are public, including 104.194.9.227 in New Jersey [2][6].
Previdian founder and CEO Ryan Dewhurst put a ceiling on it. "Although this is undoubtedly a serious vulnerability, certain preconditions make exploitation less likely," he said [12]. "Because WordPress has auto-updates enabled by default, we're likely to see mass-exploitation attempts, but relatively few actual compromises," Dewhurst said [13]. Neither company reported a confirmed compromise. The population at risk is the installs that never took the automatic update, and on those the theme layout decides the outcome.
Patched builds are 7.1.2, 7.0.6, 6.9.9 and 6.8.10, and administrators are advised to apply one of them as soon as possible and audit for signs of malicious activity [14]. Where the update cannot go on today, exploitation needs both preconditions, so renaming the page- directory or removing the web server account's read access to the target .php file denies the observed chain [3]. An audit on an unpatched host has two cheap queries: the theme root listing, and whether pearcmd.php is readable.
What to watch
- A confirmed compromise on a production site; so far the recorded volume is honeypot telemetry.
- Attackers naming readable local .php targets other than pearcmd.php, which would widen the set of exposed servers.
- Any count from Patchstack or Previdian of installs whose active theme has a top-level page- directory.