Less than twelve hours after WordPress shipped a critical security update on September 22, 2026, attackers began scanning the internet for vulnerable installs. CVE-2026-87902 — rated CVSS 9.2 — lets unauthenticated callers execute arbitrary PHP through the `get_page_template()` function, which can incorrectly include local `.php` files outside theme directories. Security firm Previdian logged 68 exploitation attempts across its honeypots from September 23 onward, with primary activity from IP 104.194.9.227 in New Jersey and additional traffic originating from Indonesia.
The bug sits in how WordPress resolves page templates. If an active theme contains a top-level directory whose name starts with `page-` — for example `page-templates` — an attacker can craft requests that cause core to include any readable PHP file on the server. Real-world chains have targeted files such as `pearcmd.php`, a utility from PHP's PEAR distribution that can write to `/tmp`, enabling a two-step kill chain: drop a malicious file, then include it through the same flaw.
Patchstack, which monitors mass-scan activity against WordPress, confirms a clear shift from reconnaissance to active exploitation. The first documented attempt arrived September 22 at 11:49 UTC — the same day as the patch — showing how quickly automated actors map CVE numbers to working exploits. Files left on compromised hosts include `wp-pear-rce-flag.php`, `poc87902.php`, `luci_.php`, and `zeta_.php`. Several chains then pull webshell uploaders from GitHub and establish persistent access.
Researcher Ryan Dewhurst notes that preconditions narrow the practical blast radius: both the theme layout and the presence of exploitable PHP files must align. That is why not every site on the internet collapses at once. Yet WordPress's widespread auto-update channel means a large share of sites patch quickly — pushing attackers to scan harder during the window before slower administrators catch up.
WordPress 7.1.2 is the primary fix; older branches receive 7.0.6, 6.9.9, and 6.8.10 respectively. For hosting providers and Nordic municipalities running many WordPress instances, distinguish core patching from theme hygiene: themes using `page-*` directory conventions need review even after upgrade, and stray utilities like `pearcmd.php` should be removed from web roots.
The incident repeats a familiar supply-chain pattern against CMS platforms: one core flaw plus a common server file equals full RCE. For newsrooms, nonprofits, and small businesses without dedicated DFIR capacity, the hours after disclosure are the most dangerous.
Evidence Rail
- Confirmed: WordPress security release September 22; Previdian honeypot logs (68 attempts); Patchstack confirms recon-to-exploit progression; first attempt September 22 11:49 UTC.
- Reported: Exploit chain via pearcmd.php and GitHub webshell uploaders; attacker IP 104.194.9.227 (NJ) and Indonesian traffic.
- Unconfirmed: Single threat group attribution or linkage to prior WordPress campaigns.
How to protect your sites
- Upgrade immediately to WordPress 7.1.2 (or 7.0.6 / 6.9.9 / 6.8.10 depending on branch).
- Inventory themes with directories starting `page-`; verify no unintended PHP files are reachable.
- Remove `pearcmd.php` and other developer utilities from production servers.
- Review web server logs from September 22 for suspicious `get_page_template` calls and unknown `.php` files in `/tmp`.
- Enable automatic security updates and WAF rules blocking known exploit patterns.
In Brief
- CVSS 9.2 RCE in `get_page_template()` was exploited the same day the patch shipped.
- 68 honeypot attacks; pearcmd.php and GitHub webshells dominate chains.
- Patch to 7.1.2 is mandatory; theme structure and leftover PHP files determine whether a site is vulnerable.