AI-generated editorial illustration; not a documentary photograph.
Attackers have moved beyond probing sites for a critical WordPress vulnerability and are now exploiting it to write files that execute shell commands when accessed. Patchstack observed the activity after WordPress released version 7.1.2 to address CVE-2026-87902, a flaw rated 9.2 out of 10 by the WordPress security team.
Exploitation followed the patch
Patchstack reports that the first malicious requests arrived at 17:44 UTC on September 22, less than five hours after the fix was released. The initial traffic focused on reconnaissance, including attempts to include ordinary WordPress core files to identify vulnerable installations. By September 23, traffic connected to the flaw had increased tenfold and included attempts to deliver payloads.
How the flaw enables code execution
CVE-2026-87902 is an unauthenticated path-traversal vulnerability in page-template resolution. Under specific conditions, an attacker can cause get_page_template() to include a readable local PHP file outside the active theme directories. Remote code execution requires a parent or child theme with a top-level directory beginning with page-, such as page-templates, plus a suitable readable PHP file on the server.
Patchstack saw payloads writing files to /tmp and /var/tmp. Some only marked a host as exploitable, while others created files containing shell-command execution code. The security firm did not publish a working request example, but said observed probes used double-encoded traversal sequences in pagename together with a valid page_id.
Who needs to act
WordPress fixed the vulnerability in 7.1.2 and backported fixes to release branches as far back as 4.7. Versions before 4.6 will not receive a fix. The official PHP Docker image is affected, as is the default cPanel configuration when it uses a PHP version older than 8.5.
Recommended response
Administrators should update to WordPress 7.1.2 as soon as possible and examine server logs for suspicious requests or newly created PHP files. Patchstack identified 169.58.48.193, 169.58.48.195 and 2001:df1:e8c0::106b as source addresses associated with the observed activity, which can also be considered for blocking.
Source: Hackers start exploiting critical WordPress flaw for code execution
SIGNAL TITANS
Leave a Reply