Security · 25 Sep 2026 · Rob Nidschelm

Attackers Are Trying to Turn a WordPress Page Into a Server Foothold

Fixes and probes share 22 September. The vendor advisory confirms a corrected weakness in template selection. That date cannot establish how much patching time preceded the probes.

CVE-2026-87902 is a path-traversal flaw: anonymous requests can make WordPress load PHP from a readable file on disk beyond its theme folders. Suitable theme and runtime conditions can turn inclusion into remote code execution.

The boundary failure is real, but account for its prerequisites

Robert Ressl’s disclosure requires a public, published page without an earlier usable custom template. A traversable directory at the root of an active parent or child theme, for example page-templates, is another prerequisite. The loader needs read access to its target, with no filesystem policy blocking inclusion. Those conditions prevent assuming that an unpatched instance necessarily permits takeover.

The demonstrated next stage needs PEAR’s command file and dependencies to be readable, register_argc_argv enabled in the runtime serving visitors, and somewhere writable. Inspect the configuration serving those requests, not just the command-line configuration. Removing these prerequisites interrupts this route without correcting the original boundary failure.

In the reproducible lab, one anonymous request creates a controlled file; a second loads it. Newer bundled themes lacked the necessary directory, so the researcher added a fixture. Its root-owned proof file is deliberately world-readable: access demonstrates the web account’s permissions, without proving root escalation or a container escape. BlackTree did not test production.

What was observed, and what it proves

Patchstack recorded the first probe at 11:49 and first file-write attempt at 15:34, both UTC that day; the latter used pearcmd.php. Its next-day update described growth beyond tenfold, attempted writes and scanning identifying itself as a Nuclei template. Attempts are not confirmed compromises.

The CISA exploited-vulnerability catalogue added the flaw on 25 September 2026. Its 28 September remediation deadline applies within the relevant US federal directive’s scope, rather than imposing a deadline on every website. The current record continues to identify known exploitation.

Match the installed branch, then investigate the earlier window

The branch map identifies corrected builds 7.1.2, 7.0.6, 6.9.9 and 6.8.10, with backports reaching 4.7.37. Older branches have their own updates, so a broad below-latest vulnerability range misclassifies patched backports. Verify every production node’s branch after deployment.

• Update the affected core immediately and verify the version actually running.
• In access logs, investigate encoded parent-directory sequences, paired pagename/page_id values, and pearcmd. Also search for config-show and config-create.
• Examine /tmp; inspect /var/tmp too. Look for unexplained PHP scripts, particularly wp-pear-rce-flag.php, poc87902.php, or randomised names starting luci_ or zeta_.
• Confirmed file writes or unexpected execution require compromise investigation, not dismissal as prevented scanning.
• Check the top level of each parent and child theme for page- directories. Their absence cannot replace patching.
• Disable unnecessary register_argc_argv for web requests; remove PEAR components accessible from the web but no longer needed.

If installation must wait, temporarily reject pagename values containing traversal. A clean probe cannot certify the installed version: permissions, template selection and runtime configuration can interrupt one chain. Distinguish the public demonstration, hostile requests and proven execution when responding.

Sources and timing

• Vendor advisory, published 2026-09-22T13:57:27Z. This advisory clock does not establish the patch-release time.
• Original technical disclosure, dated 2026-09-22; no publication clock is supplied.
• Reproduction and limitations, author’s verification dated 2026-09-22.
• First-party attack observations, published 2026-09-22T20:43:16; updated 2026-09-23T13:55:04. Page timezones unstated; event times UTC.
• Current official exploitation record, addition dated 2026-09-25; checked 2026-10-27. The feed’s publication clock does not establish the precise time of that September addition.
• The agency’s directive announcement, published 2026-06-10 at 11:00 EDT; its bulletin was sent at 11:17 EDT.