Critical WordPress Vulnerability Exploited Immediately After Disclosure

Patchstack reports that a newly patched WordPress flaw started being exploited mere hours after it became public, with activity already escalating to full-blown site takeovers. The bug, CVE-2026-87902 (CVSS 9.2), is a path traversal issue in how WordPress resolves page templates via get_page_template(), letting unauthenticated attackers pull in an arbitrary readable local .php file from outside the active theme's folder. When the active theme's top-level directory name begins with 'page-' and the server can read a chosen PHP target, this can be chained with the known pearcmd.php PEAR-to-RCE trick (requiring register_argc_argv enabled) to achieve remote code execution — a setup present in the official PHP Docker image and in default cPanel configs running PHP below 8.5. Affected theme structures include the old Twenty Twelve and Twenty Fourteen defaults as well as third-party themes like Neve, Hestia, and Sydney. WordPress fixed the issue in version 7.1.2 on September 22, with the patch backported as far as the 4.7.x line, but Patchstack says attackers crafted exploit payloads directly from the patch diff and ramped up from reconnaissance scans to live compromises by September 23, with traffic now ten times higher than on the first night and expected to keep growing given public scanning tools.