Critical WordPress Vulnerability Exploited Within Hours of Patch Release

Critical Flaw in WordPress Core Discovered

Security researchers have identified a critical vulnerability in WordPress Core, tracked as CVE-2026-87902, which allows unauthenticated attackers to perform path traversal and potentially execute remote code. According to TechRadar, the flaw has been rated 8.1 out of 10 in severity.

The vulnerability enables attackers to include local PHP files outside the active theme directories. Under specific configurations—such as parent or child themes with a top-level directory starting with ‘page-’—this can lead to remote code execution (RCE). WordPress powers over 50% of all active websites, amplifying the risk of widespread exploitation.

WordPress released a patch for the flaw on 22 September 2026 in version 7.1.2, with fixes backported to versions 4.7 and above. Versions prior to 4.8, which are no longer supported, will not receive a patch.

Attackers Move Quickly to Exploit the Flaw

Exploitation attempts began within five hours of the patch’s release, according to The Next Web. The first attacks were detected at 11:49 UTC on 22 September, shortly after the update was made available.

By midday UTC on 23 September, exploitation traffic had surged to more than ten times its initial volume. Attackers are leveraging the vulnerability to include malicious PHP files, such as pearcmd.php—a component of the PHP package manager PEAR—and writing files to server directories like /tmp and /var/tmp.

Ryan Dewhurst, founder and CEO of Previdian, reported 68 exploitation attempts. While auto-updates likely limited successful compromises, the rapid escalation of attacks underscores the urgency for admins to update immediately.

Mitigations and Recommendations

The risk of remote code execution is conditional and depends on specific configurations, such as parent or child themes with ‘page-’ directories. However, the path traversal aspect of the vulnerability is broadly exploitable, posing a critical threat to unpatched sites.

WordPress and cybersecurity firm Patchstack have urged admins to update to version 7.1.2 or the latest patched release for their branch. For those unable to update immediately, interim mitigations include blocking traversal sequences (e.g., ‘..’) in the pagename parameter and disabling the register_argc_argv setting in PHP configurations, which disrupts the exploit chain.

Dave Jong, research lead at Patchstack, emphasized the importance of these mitigations, noting that disabling register_argc_argv reduces the risk from code execution to an information leak.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This vulnerability underscores the speed at which threat actors exploit newly disclosed flaws, particularly in widely used platforms like WordPress. For founders and operators, this is a reminder of the importance of rapid patch management and proactive security measures.

The fact that exploitation began within hours of the patch’s release highlights the need for automated update systems and real-time monitoring. Manual updates are no longer sufficient, especially for a platform powering over half the web.

For startups and businesses running WordPress, this incident is a wake-up call to audit their configurations. While the RCE risk is conditional (e.g., parent/child themes with ‘page-’ directories), the path traversal aspect is broadly exploitable. Implementing interim mitigations—such as blocking traversal sequences or disabling risky PHP settings—can buy time while updates are deployed.

Finally, this situation reinforces the value of security tools like Patchstack and Previdian, which help detect and block exploitation attempts. For early-stage companies, investing in such tools or partnering with managed security providers can reduce risk without requiring an in-house security team.

Key takeaways

• CVE-2026-87902 is a high-severity (8.1) path traversal vulnerability in WordPress Core that can lead to remote code execution (RCE).
• The flaw was patched in WordPress 7.1.2 and backported to versions 4.7 and above; unsupported versions (pre-4.8) remain vulnerable.
• Exploitation attempts began within five hours of the patch release and surged tenfold within 24 hours.
• Attackers are leveraging the vulnerability to write malicious PHP files to servers, including via pearcmd.php.
• Immediate actions: update WordPress, block traversal sequences in the pagename parameter, and disable register_argc_argv in PHP settings.

FAQ

What is CVE-2026-87902?

CVE-2026-87902 is a high-severity (8.1) vulnerability in WordPress Core that allows unauthenticated attackers to perform path traversal and, under specific conditions, execute remote code on a server.

Which WordPress versions are affected?

The vulnerability affects WordPress Core versions prior to 7.1.2. Patches have been backported to versions 4.7 and above. Versions before 4.8 are unsupported and will not receive a fix.

How quickly did attackers begin exploiting the flaw?

Exploitation attempts began within five hours of the patch’s release on 22 September 2026 and escalated significantly within 24 hours.

What are the risks of this vulnerability?

Attackers can include malicious PHP files outside the active theme directories, potentially leading to remote code execution if specific configurations—such as parent/child themes with ‘page-’ directories—are present.

What should WordPress admins do to protect their sites?

Admins should immediately update to WordPress 7.1.2 or the latest patched version for their branch. If updates cannot be applied, mitigations include blocking traversal sequences in the pagename parameter and disabling register_argc_argv in PHP settings.

Related on Lazyfounder

• More technology news