WordPress zero-day under active attack as exploit chain moves to file writes
Attackers have escalated from probing vulnerable WordPress installations to actively exploiting a critical path traversal flaw, CVE-2026-87902, to drop files that execute shell commands. The vulnerability, patched in version 7.1.2, allows unauthenticated remote code execution under specific theme directory and PHP configuration conditions. Security firm Patchstack observed a tenfold surge in malicious traffic within a day of the patch's release, with payload delivery now underway.
The vulnerability lies in WordPress's page-template resolution, letting unauthenticated attackers include arbitrary readable PHP files outside theme directories. Exploitation needs a theme folder prefixed with "page-" and a readable local PHP file like pearcmd.php when PHP's register_argc_argv is enabled. The official Docker PHP image and default cPanel setups with PHP before 8.5 are affected.
Patchstack observed initial probes within five hours of the patch, then a tenfold traffic surge as attackers shifted to file-writing payloads. Files placed in /tmp and /var/tmp with names like wp-pear-rce-flag.php and luci_<random>.php either mark hosts as vulnerable or execute shell commands on access. Administrators should update to 7.1.2 and review logs for double-encoded traversal attempts in "pagename" parameters.
This active exploitation could affect a vast number of WordPress sites, especially those on older versions or with specific PHP configurations. Site owners who delay patching may face server compromise, data theft, or malware distribution to visitors. The rapid escalation from probing to payload delivery within a day shows how quickly attackers weaponize disclosed flaws. Organizations relying on WordPress should treat this as urgent, as the window between patch release and active exploitation continues to shrink.