WordPress 7.1.2 Patched as Attackers Exploit Critical Path Traversal Flaw

Key points

• WordPress patched CVE-2026-87902 in version 7.1.2, with fixes backported to all supported branches down to 4.7.37.
• The flaw allows unauthenticated attackers to include local PHP files outside theme directories, potentially leading to remote code execution.
• Patchstack observed malicious activity starting September 22, with traffic increasing tenfold by September 23 as attackers moved to writing payloads.
• Exploitation requires the active theme to have a top-level directory starting with 'page-' and the server to have readable PHP files like pearcmd.php.
• Attackers used double-encoded traversal sequences in 'pagename' requests, targeting IPs including 169.58.48.193 and 169.58.48.195.

Background

This incident follows a pattern of rapid exploitation of critical vulnerabilities in web platforms, similar to recent GeoServer and PaperCut flaws. While Microsoft's August patches for Entra ID and Azure Arc were not actively exploited, the WordPress case shows immediate wild exploitation. The vulnerability was disclosed privately by researcher Robert Ressl in July, but public exploitation began only after the September 22 patch release.

How outlets are covering it

BleepingComputer and Patchstack emphasize the active exploitation, noting a tenfold increase in malicious traffic and specific payload files like 'wp-pear-rce-flag.php'. The Hacker News focuses on the technical conditions required for exploitation, highlighting that not all affected sites are vulnerable due to server configuration differences. SecurityWeek covers a separate 'Click2Shell' vulnerability patched in 7.1.1, which is distinct from CVE-2026-87902 but part of the same release cycle. Heise online provides minimal detail, focusing on the broader security update context.

Why it matters

The rapid exploitation of CVE-2026-87902 underscores the risk of critical vulnerabilities in widely used platforms like WordPress. Site administrators must update immediately to prevent remote code execution, as attackers are actively deploying payloads. The vulnerability's conditions, while specific, affect a significant portion of the WordPress ecosystem, making prompt patching essential to prevent widespread compromise.

What to watch

WordPress users should update to version 7.1.2 or the latest patched branch immediately. Administrators should review logs for malicious activity, particularly files in /tmp and /var/tmp with names like 'poc87902.php'. Blocking the identified source IPs and disabling register_argc_argv can mitigate risk, but updating is the only definitive fix. Monitoring for further exploitation attempts is advised as the vulnerability remains critical.