Key Takeaways:
- Hackers are actively exploiting a critical WordPress path traversal flaw.
- Security researchers report a sharp rise in malicious attack traffic.
- Website administrators should install the security update to protect vulnerable sites.
Hackers have stepped up attacks by exploiting a critical WordPress path traversal flaw to write malicious files and run remote commands on vulnerable websites worldwide after a recent security update was released.
Hackers step up attacks on critical WordPress flaw
Hackers have moved from basic checks for vulnerable websites to active attacks using the serious WordPress Security Flaw tracked as CVE-2026-87902.
Security firm Patchstack saw the first malicious requests coming from a small number of IP addresses targeting protected websites. Researcher Robert Ressl discovered the flaw, which allows attackers to move outside the intended file path without logging in and, under certain conditions, run code remotely. The WordPress security team rated the issue 9.2 out of 10 for severity. This echoes the recently disclosed MongoBleed vulnerability, exploited almost immediately after its patch.
Official security notices about the WordPress Security Flaw say an attacker who does not need to log in can make WordPress load a readable local file of their choice from outside the active theme directories. However, several conditions must be met before remote code execution can work.
The active parent or child theme must have a top-level directory beginning with “page-“, such as “page-templates.” The targeted local PHP file must also exist and be readable by the web server account.
The advisory lists pearcmd.php as one example when PHP’s register_argc_argv setting is enabled. The official PHP image for Docker is also affected, as are default cPanel setups using PHP versions earlier than 8.5.
Researchers track attack traffic and methods
The first attack traffic appeared less than five hours after the security update was released and mainly focused on checking for vulnerable websites. Hackers tried to load normal WordPress core files to find targets. Malicious activity later increased tenfold as attackers began sending files designed to exploit the flaw.
Researchers found that attackers changed settings to write files to locations of their choice using content they controlled. In the third stage, attackers replace config-show with config-create, which pearcmd uses to write files containing attacker-controlled code.
Some of the files only show that a website can be attacked, while others contain short code that can run shell commands when someone accesses the file. These files are placed in temporary directories and have names such as wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php.
Investigators also found that the attacks use double-encoded path traversal strings in the pagename parameter together with a valid page_id. The identified malicious IP addresses include 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b, which administrators can block.
WordPress releases security updates for vulnerable sites
WordPress fixed the flaw in version 7.1.2. Because of the seriousness of the issue, fixes were also added to older software versions as far back as version 4.7. Versions older than 4.6 will not receive an official security update for this particular flaw.
Website administrators should update their WordPress software immediately to close the WordPress Security Flaw and protect against ongoing attacks. Security experts also recommend checking server logs for unusual requests and blocking known malicious IP addresses, per a Cyber Security Agency of Singapore advisory.
Because CVE-2026-87902 is already being actively exploited, administrators should install WordPress 7.1.2 as soon as possible and check their logs for signs of attacks. Acting quickly can help prevent attackers from taking control of a website or running remote commands on its server.
