Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Security researchers report that attackers began probing and exploiting a critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), within hours of the patch being released on September 22, 2026. The bug lets an unauthenticated attacker manipulate page-template resolution in get_page_template() to pull in an arbitrary readable local PHP file from outside the active theme, which can lead to remote code execution if the server environment and theme meet certain conditions. Honeypot data from Previdian and Patchstack shows real-world abuse using the local pearcmd.php file to drop web shells in /tmp or /var/tmp, with dozens of attempts logged from IPs in the US, Indonesia and elsewhere. Site owners are urged to immediately update to WordPress 7.1.2, 7.0.6, 6.9.9 or 6.8.10 and check their environments for signs of compromise, since mass scanning is expected even though actual successful breaches may remain limited thanks to default auto-updates.