Attackers began targeting a critical WordPress Core vulnerability within hours of its public disclosure, with security researchers observing activity progress from initial probing to attempts to write malicious PHP files and deploy web shells.
CVE-2026-87902 affects WordPress Core versions 4.7.0 through 7.1.1 and can lead to unauthenticated remote code execution under specific theme and server conditions.
WordPress has released patched versions, but administrators should also check for suspicious activity because exploitation attempts began almost immediately after details became public.
Attackers moved quickly after the flaw was disclosed
SOC Prime reported that Patchstack detected probing at around 17:44 UTC on Sept. 22, less than five hours after WordPress 7.1.2 became available. Early requests targeted harmless WordPress Core PHP files, suggesting attackers were initially testing whether sites could be reached through the vulnerable template-resolution behavior.
The activity soon became more aggressive. The Hacker News said that Previdian recorded 68 exploitation attempts beginning Sept. 23, while Patchstack observed requests trying to include pearcmd.php, write attacker-controlled PHP files to temporary directories, and retrieve a PHP upload script hosted on GitHub.
Previdian CEO Ryan Dewhurst said the vulnerability was serious, although its prerequisites could limit successful attacks. “We’re likely to see mass-exploitation attempts, but relatively few actual compromises,” Dewhurst said, according to The Hacker News.
RCE requires specific theme and server conditions
According to GitHub, WordPress rated CVE-2026-87902 9.2, Critical. Its official advisory explained that an unauthenticated attacker can manipulate get_page_template() resolution to include a chosen readable PHP file outside the active theme directories.
Remote code execution requires two main conditions. The active parent or child theme must contain a top-level directory beginning with page-, such as page-templates, and the server must contain a readable local PHP file that can be abused when included.
WordPress cited Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney as examples of themes with the relevant directory structure. The vulnerability itself resides in WordPress Core, so using one of those themes does not automatically mean a site can be successfully exploited.
WordPress admins should patch and check for compromise
Wordfence warned that administrators should not rely on current server conditions to determine whether patching can wait. Themes, plugins, PHP packages, and server configurations can change while the vulnerable Core behavior remains present.
Administrators should:
- Update WordPress Core immediately. Patched releases include WordPress 7.1.2, 7.0.6, 6.9.9, and 6.8.10, with fixes also backported to older supported branches.
- Review logs and file changes. Look for unusual traversal requests, references to local PHP files, newly created PHP files, unexpected PHP processes, outbound connections, or unauthorized administrator accounts.
- Treat WAF protection as an additional layer. Wordfence has released firewall protections for some customers, but the company still recommends patching Core rather than relying on filtering alone.
Sites that were online when exploit details became public should treat updating and investigation as separate steps. Patching closes the vulnerable path, while reviewing activity from Sept. 22 onward can help determine whether attackers reached the site before the fix was installed.
Read how CVE-2026-19949, a high-severity flaw in All-in-One WP Migration, left 3.25 million WordPress sites running vulnerable plugin versions.