461.25.09.26- Critical WordPress Vulnerability CVE-2026-87902
Severity: Critical
CVSS Score: 9.2
Affected Product: WordPress Core
Affected Versions: WordPress 4.7.0 through 7.1.1
Overview
TT-CSIRT is advising organizations using WordPress to urgently apply security updates for CVE-2026-87902, a critical WordPress Core vulnerability that allows attackers to access unintended PHP files and achieve remote code execution. Exploitation has also been observed using public scanning and proof-of-concept tools increasing the risk of automated attacks against vulnerable internet-facing WordPress sites.
Impact
- access files outside of the intended WordPress theme directory
- execute malicious PHP code
- modify or compromise website content
- access sensitive information or credentials
- establish persistence on the affected server
- use the compromised system to support further malicious activity.
Indicators of Potential Exploitation
- Suspicious directory traversal patterns in pagename parameters, including encoded values such as %2e%2e or %252e%252e.
- References to pearcmd.php, config-show, or config-create.
- Unusual requests targeting /index.php or the website root.
- Unexpected PHP files in writable directories such as /tmp or /var/tmp.
- Monitor for variations in request methods, encoding, and user-agent strings, rather than relying only on IP addresses or a single exploit pattern.
Recommended Actions
- Update WordPress immediately to version 7.1.2 or the applicable patched release.
- Confirm automatic security updates were successfully applied.
- Review web server, WAF, and application logs for suspicious activity.
- Inspect WordPress and writable directories for unexpected PHP files or artefacts.
- Apply temporary WAF/web server rules to block directory traversal attempts.
- Enforce least privilege for web server and PHP service accounts.
- Maintain secure backups and verify restoration procedures.
- If compromise is suspected, isolate the system, preserve logs, investigate, and remediate before restoring service.
TT-CSIRT strongly recommends that organizations prioritize patching and immediately review affected systems for signs of compromise.
References
- WordPress 7.1.2 Security Release
- Patchstack – CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
- Tech Insider – WordPress CVE-2026-87902 Exploited Hours After Disclosure
- Help Net Security – WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)