WordPress patched a critical remote-code-execution bug on September 22. Attackers had a working exploit in the wild by 11:49 UTC that same day — which is either impressively fast reverse engineering or proof that some people really do read patch diffs for a living.

A Path Traversal Bug With a Two-Item Checklist

CVE-2026-87902 (CVSS 9.2) lives in WordPress's get_page_template() function, the code that decides which template file loads a page. Under specific conditions it lets unauthenticated attackers reach PHP files outside the active theme directory — a textbook path traversal turned into full remote code execution.

The exploit needs two things to line up: a theme with a top-level directory starting with "page-" (like page-templates), and a readable PHP file already sitting on the server, commonly the ever-present /usr/local/lib/php/pearcmd.php. Attackers chain pearcmd.php to write malicious files into /tmp/ or /var/tmp/, then drop a web shell pulled straight from a GitHub repo.

68 Attacks in 72 Hours, and CISA Noticed

WordPress shipped fixes in versions 7.1.2, 7.0.6, 6.9.9, and 6.8.10 the same day the bug went public, and most sites with auto-updates enabled patched themselves without anyone lifting a finger. Sites that didn't weren't so lucky — telemetry logged more than 68 exploitation attempts from multiple geographic sources within three days.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 25 and gave federal agencies until September 28 to patch. If the U.S. government is working on a deadline for your CMS, so are you.

Auto-updates aren't glamorous, but neither is explaining to your boss why the company blog is now serving up someone else's web shell.

This is exactly the kind of disclosure-to-exploit sprint our free security checklist is built to help you outrun — grab it here.

Source: The Hacker News