WordPress CVE-2026-87902: Path Traversal Flaw in get_page_template() Under Active Exploitation Within Hours of Patch (CVSS 9.2)
WordPress shipped version 7.1.2 on September 22, 2026, fixing CVE-2026-87902 (CVSS 9.2, critical). The get_page_template() function has a path traversal flaw that lets attackers load an arbitrary readable PHP file outside the active theme directory instead of a theme template. Active exploitation in the wild began within hours of the patch, abusing the bundled command-line tool pearcmd.php.
TL;DR — 90 seconds
CVE-2026-87902 (CVSS 9.2, critical) affects WordPress 4.7.0 through 7.1.1. The get_page_template() function does not sufficiently validate the resulting theme path: if the active theme has a directory whose name starts with page-, an attacker can use path traversal to load an arbitrary readable PHP file outside the theme folder. Combined with pearcmd.php (part of the bundled PEAR library), which is reachable in many installations, this can be turned into full remote code execution, with no authentication and no user interaction required. Active exploitation reportedly began on September 22, 2026 at 11:49 UTC, the same day the patch shipped. Fix: update to 7.1.2 (or 7.0.6, 6.9.9, 6.8.10 for older lines).
What is the problem?
get_page_template() selects the matching theme file based on the requested page path. The function does not sufficiently check whether the resulting path actually stays inside the active theme directory. If the active theme has a directory whose name starts with page-, an attacker can manipulate the lookup with a crafted request so that an arbitrary readable .php file outside the theme folder gets included and executed.
The exploitation path observed in the wild uses pearcmd.php, a command-line tool from the bundled PEAR library that sits unnoticed but reachable in the filesystem of many installations. Attackers abuse it to write files with arbitrary content to /tmp or /var/tmp, then fetch an uploader script from an external GitHub repository to drop a full web shell.
Who is affected?
| CVE | Affected | Fix | Precondition | CVSS |
|---|---|---|---|---|
| CVE-2026-87902 | WordPress 4.7.0 – 7.1.1 | 7.1.2 (also 7.0.6, 6.9.9, 6.8.10 for older lines, backported to 4.7.37) | An active theme with a directory whose name starts with page-, plus a reachable readable PHP file outside the theme folder (typically pearcmd.php) | 9.2 (critical, CVSS v4) |
Practically every WordPress installation in the affected version range with a matching theme directory name is affected. Installations with automatic background updates enabled have generally already received the patch. Sites with auto-updates disabled or manually managed instances remain vulnerable until updated by hand.
Impact
The flaw requires no authentication and no user interaction, and is fully exploitable remotely. Successful exploitation leads to remote code execution with the privileges of the web server process, potentially resulting in a full takeover of the installation, including database access, reading configuration files, and dropping persistent web shells. Because exploitation began within hours of disclosure and reportedly continued at least through September 24, 2026, this is an actively targeted flaw, not just a theoretical risk.
Mitigation / immediate actions
Update to WordPress 7.1.2, or the matching patched version for your line (7.0.6, 6.9.9, 6.8.10), right away. Installations with automatic background updates enabled have generally already received the patch, but a manual check is still worthwhile.
# Check version (WP-CLI)
wp core version
# Update immediately
wp core update
wp core update-db
# Remove pearcmd.php or block access to it if not needed
rm wp-includes/pear/PEAR/Command.php 2>/dev/null
# alternatively, block it at the web server level (nginx example)
location ~* /wp-includes/pear/.*\.php$ { deny all; }
Also check whether your active theme has a directory whose name starts with page-, and whether template logic is actually needed there. More generally, block PHP execution in upload and temporary directories (wp-content/uploads, /tmp, /var/tmp) at the web server level, independent of this specific flaw.
Detection / verification
Check the filesystem for known artifacts of this campaign:
# Search for known file indicators
find / -iname "wp-pear-rce-flag.php" -o -iname "poc87902.php" 2>/dev/null
find / -regextype posix-extended -regex '.*/(luci|zeta)_[A-Za-z0-9]+\.php' 2>/dev/null
# Check access logs for pearcmd.php and unusual query strings
grep -i "pearcmd.php" /var/log/nginx/access.log
grep -E "page-[a-z0-9%.\/]+\.php" /var/log/nginx/access.log
Known source IP addresses from the current campaign include 104.194.9.227, 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87 and 45.61.184.170, along with several Indonesia-based address blocks. Also check for outbound connections to raw.githubusercontent.com, particularly to repositories containing web shell content, since that path has been observed for fetching the payload.
Operator recommendation
Act today if: you run a WordPress instance between 4.7.0 and 7.1.1 and have not yet updated to the patch. Patch immediately, then check for the compromise indicators listed above, since this flaw is already under active exploitation.
Monitoring is enough if: your installation is already updated to 7.1.2 or later and the detection checks show no anomalies. Keep automatic updates enabled so future similar flaws get closed faster.
Frequently asked questions about CVE-2026-87902
Why does a WordPress CVE matter to a TYPO3-focused blog?+
Many agencies and operators run mixed PHP stacks with TYPO3 and WordPress installations side by side. Leaving unused CLI tools like pearcmd.php reachable in a production webroot is also a general PHP hardening issue, not just a WordPress problem.
Is updating to 7.1.2 enough on its own?+
In most cases, yes. But if an instance was already compromised before patching, a planted web shell survives the update. A check for the indicators listed above is worthwhile as well.
Are all themes equally affected?+
Only themes with a directory whose name starts with page- meet the first precondition for this flaw. Many popular themes use that naming pattern for page templates, which is why real-world exposure is high.
What does pearcmd.php do in a WordPress installation?+
pearcmd.php is a command-line tool from the bundled PEAR library dependency. It is not required for a site's regular operation, but it stays reachable, unnoticed, in many installations.
How quickly did active exploitation start?+
Reports place the start of active exploitation at September 22, 2026, 11:49 UTC, the same day the patch shipped. That is a very short window between disclosure and exploitation.
Is there evidence of targeted attacks rather than broad scanning?+
Current reporting suggests the activity is opportunistic and broadly distributed rather than aimed at specific organizations. Attribution has not been clearly established so far.
Conclusion
CVE-2026-87902 follows a familiar pattern: a seemingly harmless path function, an unused but reachable helper file, and active exploitation on the open internet within hours. For operators of any PHP-based CMS, not just WordPress, the lesson stays the same: automatic updates are not a nice-to-have, and bundled CLI tools you do not need should be removed or blocked from the reachable webroot.
Sources
I manage mixed PHP stacks across TYPO3, WordPress and other CMS platforms on an ongoing basis, including patch management and hardening of unneeded components.
Version monitoring across multiple CMS platforms, hardening of upload and temporary directories, incident response when compromise is suspected.
Platform operations, not paper advice: I review, patch and harden your infrastructure on an ongoing basis.