Hackers Exploit WordPress RCE Flaw After Patch Release

Attackers have moved from probing a WordPress RCE flaw to attempting to write malicious files onto vulnerable sites. Some observed payloads could run shell commands if someone accesses the files, according to security firm Patchstack.

Attacks Began Hours After the Patch

The vulnerability, CVE-2026-87902, received a critical severity score of 9.2 out of 10. WordPress fixed it in version 7.1.2 on September 22, 2026.

Patchstack recorded its first malicious requests less than five hours after the patch appeared. At first, attackers tried to include ordinary WordPress files, apparently to identify vulnerable sites.

However, attack traffic later increased tenfold. Researchers then saw requests designed to write PHP files to disk. Some files simply marked a site as vulnerable, while others contained code that could execute a shell command when accessed.

Patchstack described these as exploitation attempts. Its observations do not establish how many sites attackers successfully compromised.

Code Execution Requires Specific Conditions

The WordPress RCE flaw is an unauthenticated path traversal issue in page-template handling. It can cause WordPress to include a readable PHP file outside the active theme directories.

Remote code execution requires additional conditions. The active theme must contain a top-level directory whose name begins with page-. The attacker must also identify a suitable local PHP file that the web server can read.

For example, the WordPress advisory identifies pearcmd.php as a possible target under certain PHP settings. It also notes that some common Docker and cPanel configurations meet those conditions.

Site Owners Should Update and Review Logs

WordPress has released a fix in version 7.1.2 and backported it to branches as far back as 4.7. Therefore, administrators should install the appropriate patched release for their branch promptly.

They should also review web logs for suspicious page requests and investigate unexpected PHP files, particularly in temporary directories. Patchstack observed attackers attempting to place files in /tmp and /var/tmp.