WordPress CVE-2026-87902: Probing and PHP File-Write Attempts Observed on Patch Day

1. Basic Information

• Original Title: CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
• Published Date: 2026-09-22
• Updated Date: 2026-09-23
• Collected Date: 2026-09-24T08:09:37+09:00
• Source: Patchstack
• Severity: critical
• Type: Threat Intelligence
• Target Period: 2026-09-23T08:14:06+09:00 - 2026-09-24T08:09:37+09:00 (Asia/Tokyo)
• Original Reference: CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
• Related References: WordPress Security Advisory GHSA-7hp8-65ch-5whp, BleepingComputer: Hackers start exploiting critical WordPress flaw for code execution
• Severity Basis: The CVSS v4.0 score is 9.2. It leads from unauthenticated LFI to conditional RCE. Requests targeting file writes were observed on the day the patch was released, and traffic volume exceeded ten times that of the first day by the next day. Based solely on the published requests, successful file writes or code execution on individual sites cannot be confirmed.
• Reason for Update: Corrected the prerequisite condition to directories starting with page-, and aligned official patch versions across all branches. Distinguished attack requests, file writes, and PHP execution, and updated mitigations and phrasing.

2. Executive Summary

A path traversal vulnerability in the WordPress core leading to local file inclusion (LFI) can result in unauthenticated RCE depending on theme and PHP environment conditions. Patchstack has observed requests probing and attempting PHP file writes starting on the day the patch was released.

3. Attack Flow

Observed Request Stages and RCE Path when Conditions are Met

1. An attacker sends a page_id pointing to an existing page and a pagename containing an encoded path traversal. Both GET and POST requests have been observed.
2. If a directory starting with page- exists directly under a active theme or its parent theme, page template resolution processing can cause local file inclusion of readable .php files outside the theme.
3. In environments where pearcmd.php exists and register_argc_argv is enabled, requests are sent to check PEAR availability using config-show.
4. Requests attempting to write PHP code to /tmp or /var/tmp using config-create have also been observed. File writes require write permissions to the destination directory.
5. If the write succeeds, executing the file further through vulnerable file inclusion can lead to RCE. Files in /tmp are typically not directly accessible via HTTP, so the evidence of writes and execution must be verified separately.

4. Attacker Position and Execution Location

• Unauthenticated external attacker capable of sending HTTP requests to public WordPress pages
• Scanners utilizing public Nuclei templates and similar tools

5. Visibility for Victims and Administrators

Victims

• Regular visitors usually see no visible changes

Administrators and SOCs

• Suspicious requests in access logs containing pagename, page_id, %2e%2e/%252e%252e, pearcmd, etc.
• Unknown PHP files in /tmp or /var/tmp
• Command execution or outbound communication originating from the web process

6. Success and Failure Conditions

Success Conditions

• Using an unpatched vulnerable version and having requests reach the template resolution processing for an existing page
• A directory starting with page- (e.g., page-templates) must exist directly under a active theme or its parent theme
• The target local .php file must exist and be readable by the web server execution account
• For PEAR-based RCE, pearcmd.php and register_argc_argv=On must be available, along with write permissions to the destination and a pathway to read the written PHP

Failure Conditions and Mitigations

• Update to WordPress 7.1.2 or the official patched version for your active branch. Refer to the official WordPress advisory in the related references for a complete list of patched versions.
• Remove unnecessary PEAR from the web execution environment, and disable register_argc_argv if it is not needed. Use this as a temporary mitigation after verifying compatibility, while also applying core updates.
• Block encoded path traversals and PEAR exploitation using a WAF. Do not rely solely on a single request string or User-Agent.
• Restrict the directories that the web process can read and write to. Mounting /tmp with noexec alone does not prevent file reading and execution by the PHP interpreter.

7. What Happens Upon Success

• Successful inclusion can execute PHP code from a readable local file outside the theme directories. The impact depends on the included file.
• When conditions are met, writing a PHP file and subsequently including it can lead to RCE under the web server execution privileges.
• Inference: Code execution may lead to site defacement, credential theft, and malware deployment.

8. Observable Logs

Email

• No initial intrusion via email has been reported.

Proxy / SWG / DNS

• Encoded traversal sequences (%2e%2e or %252e%252e) in the pagename parameter (query string or POST body), especially when accompanied by page_id
• URIs and queries containing pearcmd, +config-show, and config-create

Endpoint / EDR

• Creation of PHP files in /tmp and /var/tmp by the web process
• Launch of shells, curl, wget, etc., from PHP-FPM or Apache processes executing PHP. When using nginx, check the PHP-FPM side as well.

Identity / IdP

• Exploitation does not require a WordPress login. Investigate subsequent account or session changes separately.

SaaS / Cloud

• Exploit detection alerts and file integrity events from managed WordPress services or WAFs

Network

• Sequence of requests progressing from stage 1 to 2 to 3 from the same source IP
• Outbound connections following the execution of new PHP files

9. Attack Success Determination

Confirmed in Public Information

• Attack attempts observed (success unconfirmed): Public information from Patchstack firewall telemetry confirms probing requests and requests targeting PHP writes. While the article assesses that this progressed to RCE, the creation of files or successful execution of attacker code on individual sites cannot be confirmed solely from the published requests. Scope: Patchstack public request telemetry

10. Investigation Playbook

Trigger

• CVE pattern requests, pearcmd requests, /tmp PHP files, and web process-originated commands

Initial Response

• Check the core version, directories directly under valid parent/child themes, PEAR, register_argc_argv, and web process read/write permissions.
• Preserve raw access logs and WAF logs for the relevant timeframe.
• Collect metadata and hashes of files in /tmp, /var/tmp, and the web root.

Endpoints and Servers

• Check web process lineage, child processes, additional plugins, themes, users, cron, and systemd.
• Investigate PHP OPcache and temporary files as well.

Authentication and Cloud

• Check WordPress administrators, application passwords, and hosting management console sessions.
• Investigate potential access to database and cloud credentials, and modify or revoke them based on the scope of exposure.

Follow-up Operations

• Search for web shells, redirects, SEO spam, credential theft, and outbound C2.

Containment

• Place affected sites into maintenance mode or isolate them, and update to a patched version.
• Remove unknown PHP files after preservation, and update or revoke secrets and sessions.
• Immediately apply WAF virtual patches.

Judgment Categories

• Distinguish between request observation, vulnerable file inclusion, file creation, attacker PHP execution, and subsequent compromise. Do not assume code execution was successful based solely on the presence of unknown files; cross-reference contents, creators, responses, and processes.

11. Defense and Detection Ideas

Single Events

• Encoded traversal sequences in pagename, in either the query string or POST body, especially when accompanied by page_id
• pearcmd +config-show/config-create
• PHP writes to /tmp by the web process

Temporal Correlation

• Correlate core file inclusion probes -> PEAR probes -> file writes -> PHP inclusion requests -> child processes.

Threat Hunting

• Review access logs from September 22, 2026, at 11:49 UTC onwards, searching for published User-Agents and query patterns.

Log Gaps

• Query strings being omitted by CDNs/WAFs results in the loss of key evidence.
• Files in /tmp may be lost during container recreation, cleanup, or a restart if /tmp uses tmpfs. Preserve relevant artifacts promptly.

Priority Actions

• Update WordPress
• Apply WAF virtual patches
• Remove unnecessary PEAR
• File integrity monitoring
• Web process least privilege

12. Facts, Inferences, and Hypotheses

Facts

• CVE-2026-87902 is an unauthenticated path traversal/LFI vulnerability in the WordPress core with an official CVSS v4.0 score of 9.2.
• Affected releases span the WordPress 4.7–7.1 branches, excluding the patched releases listed in the official advisory.
• Exploitation requires a directory starting with page- directly under a active theme or its parent theme and a readable local .php file. PEAR-based RCE requires conditions such as pearcmd.php and register_argc_argv=On.
• Patchstack observed and blocked the first probing request on September 22, 2026, at 11:49 UTC, and observed the first request attempting to write a file via PEAR at 15:34 UTC.
• Traffic on September 23 exceeded ten times that of the first day, and User-Agents referencing Nuclei templates containing the CVE name were also observed.
• Observed requests progressed from verifying core file inclusion to PEAR config-show and attempted PHP writes via config-create. Requests included verification markers and PHP designed to invoke shell commands upon execution.

Inference

• Public PoCs and Nuclei templates may drive continued large-scale probing of unpatched sites.
• Probing requests may reach sites even without directories starting with page-, so differentiate between request detection and vulnerability exploitation/success.

Hypotheses

No additional hypotheses. Unconfirmed items are listed in 'Unknowns and Additional Investigation'.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Exploits unauthenticated path traversal/LFI.
T1059.004	Command and Scripting Interpreter: Unix Shell	medium	PHP included in observed requests aims to execute shell commands. Successful execution on individual hosts is unconfirmed.

14. Unknowns and Additional Investigation

• Number of successfully compromised sites
• Subsequent payloads and attacker attribution
• Actual update rates across WordPress maintenance branches
• Percentage of public sites meeting conditions such as page- prefixed directories and PEAR

15. Impact on SOCs and Organizations

When updating WordPress, verify theme and PHP execution environment conditions in addition to the core version. High volumes of probing requests do not indicate successful compromises. SOCs should separately corroborate requests, responses, file creation, and PHP execution, and investigate sites and credentials based on the scope where success is confirmed.

16. Summary by Role

SOC

Correlate requests/responses, PHP writes to /tmp, etc., and PHP process activity to distinguish between attempts, file writes, and code execution.

Administrators

Update to the official patched version for your active branch, and review unnecessary PEAR and PHP settings.

General Users

Site administrators must apply updates and investigate potential exploitation. Ordinary visitors cannot remediate this vulnerability.