What happened
On September 22, 2026, WordPress released 7.1.2 and security updates for every branch back to 4.7. They fix CVE-2026-87902, a flaw in how WordPress picks the template for a page. A stranger can trick it into loading a PHP file from somewhere else on the server, and under the right conditions that becomes remote code execution: running their own code on your site without a login. WordPress rates it critical, 9.2 out of 10.
Patchstack saw the first probes at 11:49 UTC the same day and the first attempts to write files to servers by 15:34 UTC. By the next day the traffic was more than ten times higher, and a ready-made scanning template was circulating. CISA added the flaw to its Known Exploited Vulnerabilities list on September 25.
Who is at risk
Every WordPress version from 4.7 through 7.1.1 has the flaw. A full takeover needs two more things, according to WordPress’s advisory:
- The theme: the active theme (or its parent) has a top-level folder whose name starts with page-, such as page-templates. WordPress names Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as examples.
- The server: a usable PHP file is readable on the server. The known attack uses PEAR’s pearcmd.php, and WordPress says default cPanel setups running PHP before 8.5 qualify. That describes a lot of shared hosting.
Sites that don’t meet both conditions still have the flaw and still get probed. Update regardless; the conditions only decide how bad a successful attack gets.
What to do today
- Check your WordPress versionIn WordPress, go to Dashboard, then Updates. Our free website check also reads it when the site shows its version publicly, and flags it if the fix is missing.
- Update to the fixed release for your branch7.1.2, 7.0.6, 6.9.9 or 6.8.10 for current sites; 6.7.9, 6.6.9, 6.5.12, 6.4.12 and so on for older branches, all the way back to 4.7.37. WordPress installs minor security releases automatically by default, but sites where an agency turned that off, or that are stuck on a very old version, often miss them.
- Move up if you’re on an old branchA site still on 5.x or early 6.x technically has a fixed release, but it is missing years of other fixes. Plan the move to a current version.
- Look for signs of an attackEspecially if your theme is on the list above and the site wasn’t updated until recently. See the next section.
If you can’t update right away
There is no official workaround; updating is the fix. Patchstack suggests two stopgaps: have your host or firewall reject requests where the pagename parameter contains “..” (or its encoded forms, %2e%2e and %252e%252e), since a real page address never does; and turn off register_argc_argv in PHP, which breaks the known attack chain but doesn’t close the flaw itself.
Signs of an attack
From Patchstack’s write-up. In your access logs or on the server, look for:
- A pagename parameter containing %2e%2e or %252e%252e, or pagename and page_id together on the home page
- Any request containing pearcmd, +config-show or +config-create
- The user agents cve-2026-87902-poc/1.0 or nuclei-cve-2026-87902/1.0
- Unexpected .php files in /tmp or /var/tmp. Patchstack says finding these means an attack got through and the server should be treated as compromised
If you find any of it, change the site’s passwords and keys and plan on a full cleanup. Our incident response team can take it from there.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.