A critical flaw in WordPress was targeted within hours of a security update, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. The bug could enable remote code execution on affected sites under specific conditions. Website owners should check their versions and apply the relevant fix promptly.
Key takeaways
- CVE-2026-87902 affects WordPress releases from version 4.7.0 up to 7.1.1.
- WordPress issued fixes on 22 September, including version 7.1.2.
- Attack attempts were detected within hours; confirmed compromises have not been established in the reports cited.
- A WordPress maintenance plan can help keep core software updated and security checks on schedule.
How the vulnerability works
The flaw affects get_page_template(), a WordPress function that selects a page’s template. In certain configurations, an unauthenticated attacker could manipulate it to load a readable PHP file outside the active theme’s directories. If the right conditions are present, this may allow code to run on the website’s server.
Researchers said exploitation requires both a top-level theme folder beginning with “page-” and an accessible PHP file on the server. Attackers observed so far searched for pearcmd.php, a file associated with the PEAR package manager, and used it in attempts to write files to temporary directories. These requirements limit exposure, but do not remove the need to patch.
Exploitation began soon after the fix
WordPress released version 7.1.2 on 22 September and issued fixes for affected older branches back to version 4.7. Patchstack reported the first attack attempts at 11:49 UTC that day. Traffic rose afterwards, reaching more than ten times its initial level around midday UTC on 23 September, according to the company.
Previdian recorded 68 exploitation attempts, but the available reports do not establish how many sites were successfully compromised. WordPress’s automatic updates, enabled by default, may help many sites receive fixes quickly; administrators should still verify that their installations are protected.
CISA adds the flaw to its catalog
CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog and set a 24 September 2026 remediation deadline for U.S. federal agencies. The agency’s catalog highlights vulnerabilities known to be exploited and requires federal civilian agencies to address listed issues within the specified timeframe. Private organisations can also use the catalog to prioritise security work.
What site owners should do
Update to WordPress 7.1.2 or the patched release for your site’s branch, then confirm the update completed successfully. If you manage several sites, check each one rather than assuming automatic updates covered them all. A WordPress care plan or maintenance plan can make routine updates, monitoring and follow-up checks part of a consistent process.
Patchstack also recommends blocking “..” sequences in the pagename parameter and disabling PHP’s register_argc_argv setting to disrupt the observed pearcmd.php technique. These are additional precautions, not substitutes for installing the official WordPress fix.
- Hackers exploited a critical WordPress flaw within hours of the patch, The Next Web.
- U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog, Security Affairs.
- WordPress Fixes Critical Vulnerability Amid Rising Exploits, RS Web Solutions.
- WordPress Vulnerability Exploited Shortly After Patch Release, RS Web Solutions.