Technology Miraj Islam September 25, 2026 0 Comments

Hackers Are Targeting a Critical WordPress Flaw, So Be on Your Guard

WordPress Core Flaw CVE-2026-87902 (Path Traversal, Severity 8.1) Allows PHP File Inclusion and Possible RCE
Patch released in v7.1.2 and backported to 4.7+; The exploitation began within hours and is now widespread.
Administrators need to update urgently; Interim mitigations include blocking sequence traversals and disabling risky ARP/PHP configurations.

Researchers say hackers are actively exploiting a high-severity vulnerability in WordPress that can lead to a complete takeover of the website. A patch is available and WordPress users are urged to update immediately or risk losing access to their assets.

Discovered by security researcher Robert Ressl, the vulnerability in question is tracked as CVE-2026-87902. It is an unauthenticated path traversal bug 8.1/10 (high severity) affecting WordPress Core. According to WordPress itself, as well as the National Vulnerability Database, the bug can lead to the inclusion of local PHP files and, in certain scenarios, remote code execution (RCE).

“An unauthenticated attacker can cause the page template resolver get_page_template() to include a readable local .php file chosen outside of the active theme directories,” the official security advisory said.

Achieve ROSC

WordPress is the world’s #1 website building and hosting platform, supporting more than half of all active websites on the internet right now. However, that does not mean that everyone is susceptible to RCE. Only websites that check these boxes are at risk:

Sites with parent or child themes that have a top-level directory with a name starting with ‘page-‘ (for example, ‘page-templates).

Threat actors should target a local .PHP file that exists and can be read by the web server.

The web server account must be able to read the included file (for example, pearcmd.php, if the PHP Register_argc_argv setting is active).

WordPress said that both the official PHP image for Docker and the default cPanel settings are affected (although users must be running a version of PHP earlier than 8.5).

The issue was fixed in version 7.1.2, which is now available for download. Fixes were also supported in previous versions up to 4.7. It was said that versions prior to 4.8 are not supported and will not receive a fix.

Attack vulnerable websites

WordPress security company Patchstack said the first exploitation attempts began about five hours after the patch was released, and were primarily reconnaissance efforts. In the following hours, malicious activity was said to have increased tenfold, as criminals also began attempting to deliver malicious payloads to vulnerable websites.

“When this post first appeared, every request we had seen was an acknowledgment of harmless core files,” Patchstack said. “That is no longer true. Attackers now include pearcmd.php and use it to write PHP files to disk, and there are public scanning tools in circulation for this CVE.”

At first, Patchstack said the attacks came from a handful of IP addresses and advised website administrators to simply block them. However, the attacks have become quite widespread, meaning that blocking individual addresses is no longer a viable strategy. They urge everyone to apply the patch without delay:

“The first evening came from a small group of addresses. Now it is distributed in a few hundred, so blocking individual sources is not a strategy. Those who are most vocal at the time of writing:

43.250.53.42

180.251.159.243

195.178.110.247

107.189.14.87

45.61.184.170

92.246.130.76

File write attempts specifically come from a much smaller subset of those addresses, which is the usual pattern of a few operators acting on results that produced a much larger scan population.”

Those that cannot be updated immediately should reject traversal sequences in the page name parameter, Patchstack added. A real page slug never contains one, they added, meaning it can be blocked without affecting normal traffic. Also, disabling Register_argc_argv doesn’t fix the inclusion but it does break the pearcmd chain, which is the difference between an information leak and code execution.

Through beepcomputer