Attackers Exploit WordPress Path Traversal Flaw Within Hours of Patch Release

Key points

• CVE-2026-87902 is a critical flaw in WordPress's get_page_template() function, allowing unauthenticated attackers to load PHP files outside theme directories.
• The vulnerability affects all versions from 4.7.0 to 7.1.1, with a CVSS score of 9.2.
• Remote code execution requires specific conditions: a theme with a 'page-' folder and PHP's register_argc_argv setting enabled.
• Attackers began exploiting the flaw within hours of the September 22 patch, with malicious traffic increasing tenfold by September 23.
• WordPress backported the fix to all supported branches, including 4.7.37, and recommends immediate updates for all site owners.

Background

This incident follows a pattern of critical path traversal vulnerabilities in major software platforms, such as GitLab's CVE-2026-85706 in August 2026. WordPress's rapid patching and backporting to older branches reflect the severity of the threat, especially given the immediate exploitation observed. The vulnerability was disclosed privately by researcher Robert Ressl in July 2026, with public details released alongside the fix.

How outlets are covering it

The Hacker News and Help Net Security emphasize the technical details of the flaw and the conditions required for exploitation, noting that not all sites are equally vulnerable. SecurityWeek highlights a separate 'Click2Shell' vulnerability patched in the same release, which could lead to RCE via theme installation. BleepingComputer and Patchstack focus on the active exploitation, detailing the progression from reconnaissance to file writing and shell command execution. Patchstack also provides specific IP addresses to block and warns of public scanning tools for the CVE.

Why it matters

The immediate exploitation of CVE-2026-87902 underscores the critical nature of the vulnerability and the need for rapid patching. Site owners who delayed updates after the September 17 security release remain exposed. The active exploitation and public availability of scanning tools increase the risk of widespread compromise, particularly for sites with older PHP versions or themes with 'page-' folders. Immediate action is required to mitigate potential remote code execution and data breaches.

What to watch

Site owners should update to WordPress 7.1.2 or the appropriate backported version immediately. Administrators should review logs for malicious activity, including files named wp-pear-rce-flag.php or poc87902.php in /tmp or /var/tmp. Blocking the identified source IPs (169.58.48.193, 169.58.48.195, 2001:df1:e8c0::106b) is recommended. Security teams should monitor for further exploitation attempts and ensure register_argc_argv is disabled for web requests as a temporary mitigation.