WordPress Core RCE Flaw CVE-2026-87902 Exploited in the Wild

Executive Summary

A critical, unauthenticated remote code execution vulnerability impacting WordPress Core—tracked as CVE-2026-87902 with a CVSS v3.1 score of 9.2 (Critical)—is facing widespread automated exploitation across the global Internet. Discovered by security researcher Robert Ressl, the vulnerability resides in WordPress Core's get_page_template() page-template resolution logic, enabling unauthenticated remote adversaries to induce arbitrary local file inclusion (LFI) outside active theme directories.

Telemetry captured by security monitoring provider Patchstack reveals that initial scanning commenced less than five hours after security fixes were released in WordPress version 7.1.2. Within 24 hours of disclosure, exploit traffic surged tenfold as threat actors transitioned from initial environmental reconnaissance to active payload delivery, writing weaponized PHP web shells to disk.

The vulnerability represents an acute threat to containerized and shared hosting deployments. Environments running official PHP Docker images or default cPanel configurations where PHP's register_argc_argv directive is enabled are directly susceptible to unauthenticated remote code execution via command-line parameter poisoning in bundled PEAR components (pearcmd.php).

Technical Vulnerability Analysis & Attack Chain

The exploit sequence leverages an architectural weakness in template hierarchy traversal combined with legacy PHP runtime behaviors:

1. Unauthenticated Template Parameter Traversal: An attacker issues an unauthenticated HTTP GET request containing double-encoded directory traversal sequences within the pagename query parameter, accompanied by a legitimate page_id value. When WordPress processes the request, get_page_template() improperly normalizes the input, allowing the template resolution routine to break out of the active theme folder.
2. Theme Directory Prerequisite & File Inclusion: For the traversal to execute successfully, the target site's active parent or child theme must contain a top-level directory beginning with the prefix page- (such as page-templates). The attacker then points the traversal string toward a readable local PHP file on the hosting file system.
3. pearcmd.php Parameter Poisoning: When the target web host runs a PHP configuration with register_argc_argv = On (the default setting in official PHP Docker container images and numerous commercial cPanel installations), URL query parameters are automatically copied into the global $_SERVER['argv'] array. The adversary points the template inclusion to /usr/local/lib/php/pearcmd.php or vendor-specific PEAR paths.
4. Arbitrary Webshell File Creation: The attacker passes command-line arguments to pearcmd.php via the URL, invoking the config-create subcommand. This instructs PEAR to create a new configuration file at an arbitrary writable file system path—typically /tmp or /var/tmp—with file contents containing base64-encoded or raw PHP code.
5. Execution of Staged Payload: The threat actor issues a follow-up traversal request to include the newly dropped file (e.g., /tmp/wp-pear-rce-flag.php or /tmp/poc87902.php), triggering immediate execution of the embedded PHP code in the security context of the web server (www-data or nobody).

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

The observed exploitation activity exhibits traits of opportunistic, distributed threat actors and initial access brokers (IABs). Within hours of WordPress deploying security advisories, automated scanning clusters originated from distinct autonomous systems.

Rather than executing single targeted intrusions, the operators are utilizing mass scanning botnets to identify susceptible WordPress instances globally. Once confirmed, secondary stages deliver webshells to secure persistent initial access for potential resale or follow-on ransomware staging.

Observed source IP addresses driving the automated probe waves include 169.58.48.193, 169.58.48.195, and IPv6 address 2001:df1:e8c0::106b.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Upgrade WordPress Core: Immediately update all WordPress installations to version 7.1.2. Fixes have been backported to all historical branches from 7.1 down to version 4.7 (branches 4.6 and older will not receive security patches and must be upgraded).
• Disable register_argc_argv: Modify your server's php.ini configuration to set register_argc_argv = Off. This completely neutralizes the ability of attackers to pass CLI arguments to pearcmd.php via HTTP GET requests.
• Remove pearcmd.php: In Docker container images, remove unused PEAR utilities by deleting /usr/local/lib/php/pearcmd.php and associated command-line wrappers if PEAR functionality is not strictly required.

2. Network & Perimeter Defenses

• Deploy Web Application Firewall (WAF) inspection rules that block inbound HTTP requests containing double-encoded path traversal sequences (e.g., %252e%252e%252f or ..%2f) within URL parameters pagename and page_id.
• Configure perimeter firewall rules to block inbound traffic from confirmed scanning IP addresses 169.58.48.193 and 169.58.48.195.
• Restrict web server execution permissions in temporary directories (/tmp, /var/tmp, /dev/shm) by mounting them with the noexec flag where feasible.

3. Endpoint Detection & Hunting Query

title: Suspicious WordPress Pearcmd Web Shell Generation in Temporary Directories
id: 3b9c1d45-7e82-4f10-9012-123456789abc
status: experimental
description: Detects web server processes invoking pearcmd.php with config-create parameters or creating executable PHP scripts in /tmp directories.
author: CyberNewsAI Threat Intelligence
references:
  - https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/
tags:
  - attack.t1190
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_pear:
    Image|endswith:
      - '/php'
      - '/php-fpm'
    CommandLine|contains:
      - 'pearcmd.php'
      - 'config-create'
      - '/tmp/'
  selection_files:
    Image|endswith:
      - '/php-fpm'
      - '/httpd'
      - '/nginx'
    CommandLine|contains:
      - 'poc87902.php'
      - 'wp-pear-rce-flag.php'
      - 'luci_'
      - 'zeta_'
  condition: selection_pear or selection_files
falsepositives:
  - Legitimate automated administrative command-line PEAR configuration tasks
level: critical

// Microsoft Sentinel / Defender Hunting Query: Detect Web Server File Creation in Temporary Paths and Pearcmd Execution
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("/tmp", "/var/tmp", "/dev/shm")
| where FileName endswith ".php"
| where InitiatingProcessFileName in~ ("php-fpm", "httpd", "nginx", "apache2", "php")
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Network Indicators

Dropped File Artifacts