# WordPress 7.1.2 patches core RCE path as attackers move from probes to active exploitation WordPress 7.1.2 fixes CVE-2026-87902, a critical Core flaw that can let unauthenticated requests include local PHP files outside the active theme. Fresh telemetry now shows attackers have progressed from reconnaissance to using pearcmd.php to write attacker-controlled PHP files. The exploitation boundary has moved since disclosure: early traffic was probing, but September 23 telemetry shows attempts to turn the conditional file-inclusion path into code execution. RCE still depends on theme and server prerequisites, so exposure is serious but not universal. - Status: Active - Published: 2026-09-23T19:03:19+12:00 - Updated: 2026-09-24T23:03:14+12:00 - Categories: Web Development, WordPress - Tags: CVE-2026-87902, cybersecurity, remote code execution, WordPress 7.1.2 - Canonical HTML: https://beyondthe.news/dossiers/wordpress-7-1-2-cve-2026-87902-page-template-file-inclusion-rce-probing ## Latest material change Active exploitation has now progressed beyond reconnaissance: Patchstack/Previdian telemetry on Sep 23-24 shows pearcmd.php inclusion used to write attacker-controlled PHP files, so the dossier should no longer describe observed activity as probing only. ## What changed WordPress released 7.1.2 on September 22 to fix CVE-2026-87902. An unauthenticated attacker can influence page-template resolution so WordPress includes a chosen readable local PHP file outside the active theme directories. Early telemetry showed probing within hours. By September 23, Patchstack and Previdian were observing active exploitation attempts that included pearcmd.php and used it to write attacker-controlled PHP files to /tmp or /var/tmp. Previdian recorded 68 exploitation attempts beginning September 23. WordPress is backporting the fix across security-eligible branches through 4.7. ## Why it matters This is a WordPress Core exposure rather than a vulnerable optional plugin, and it needs no account or victim interaction to reach the vulnerable path. The RCE outcome remains conditional on theme and server configuration, but the threat has progressed beyond scanners merely testing the vulnerable route: attackers are now attempting file writes and payload execution. Sites updated to 7.1.1 only days earlier are still affected, making immediate version verification, patching and compromise hunting important. ## The bug lets page-template resolution escape the theme The vulnerable path is WordPress Core's get_page_template() resolution. Crafted input can survive sanitisation in encoded form, later decode into traversal sequences and cause WordPress to include a readable local PHP file outside the active theme directories. WordPress describes the flaw as critical and recommends immediate updating. ## Remote code execution depends on the host and theme Local file inclusion does not automatically mean attacker-supplied code executes on every installation. The documented RCE path needs an active theme with a suitable top-level page-* directory and a server-side PHP file whose behaviour is useful when included. Hosting configuration, filesystem contents, PHP settings and theme structure therefore materially affect exploitability, but operators should patch rather than relying on assumed environmental safety. ## Attackers have moved from probing to payload-bearing exploitation attempts Patchstack first saw reconnaissance on September 22 using the encoded traversal and page_id combination needed to reach the vulnerable path. Fresh September 23 telemetry shows escalation: attackers are including pearcmd.php and attempting to write attacker-controlled PHP files into locations such as /tmp and /var/tmp. Previdian reported 68 exploitation attempts beginning September 23, while Patchstack independently observed the same shift. These are active exploitation attempts; public telemetry still does not establish how many sites, if any, were successfully compromised. ## The patch reaches old branches, but 7.1.2 is the clean current boundary WordPress 7.1.2 contains the fix for the current release. Security fixes were also backported to maintained older branches, including 7.0.6, 6.9.9 and 6.8.10 and continuing through 4.7.37. Sites should install the patched build for their branch immediately, while recognising that WordPress actively supports only the latest release. ## Key details - WordPress 7.1.2 was released September 22, 2026 with the CVE-2026-87902 security fix. - CVE-2026-87902 can let an unauthenticated attacker make page-template resolution include a chosen readable local PHP file outside active theme directories. - Remote code execution is conditional on theme structure and server environment; it is not automatic on every affected installation. - Patchstack observed initial probing within hours of disclosure, then payload-bearing exploitation attempts by September 23. - Observed exploitation attempts include pearcmd.php to write attacker-controlled PHP files into /tmp and /var/tmp. - Previdian reported 68 exploitation attempts beginning September 23, 2026. - A site that updated to WordPress 7.1.1 still needs the newer security fix. ## Builder takeaways - Update to WordPress 7.1.2 or the patched release for your maintained branch immediately, and verify the update actually completed. - Do not treat the lack of a known exploitable theme/server combination as a durable mitigation; the vulnerable Core behaviour remains until patched. - Review access logs from September 22 onward for double-encoded traversal in pagename, especially when paired with page_id, and look specifically for pearcmd.php inclusion attempts. - Inspect /tmp, /var/tmp, web roots and other writable locations for unexpected PHP files and correlate filesystem changes with suspicious requests. - If evidence shows successful file writes or execution, handle the site as potentially compromised rather than merely exposed. ## What to watch - Confirmed compromises or broader mass exploitation of CVE-2026-87902. - Whether CISA adds CVE-2026-87902 to the Known Exploited Vulnerabilities catalog. - Additional theme or hosting configurations shown to satisfy the RCE preconditions. - Indicators, payload families and infrastructure associated with exploitation campaigns. ## Uncertainties - Public telemetry confirms active exploitation attempts but does not establish the number of successfully compromised sites. - The proportion of WordPress installations satisfying the documented theme and server preconditions is not established. - Observed attacker techniques may evolve beyond the currently documented pearcmd.php route. ## Sources - [WordPress 7.1.2 Release](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/) — WordPress.org · primary/vendor · 2026-09-22T00:00:00+12:00. Official release, vulnerability description, immediate-update guidance and backport policy. - [CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch](https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/) — Patchstack · primary security telemetry · 2026-09-22T00:00:00+12:00. Initial probing timeline and request patterns; subsequently updated telemetry documents progression toward active exploitation. - [Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure](https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html) — The Hacker News · specialist/independent · 2026-09-24T00:00:00+12:00. Reports fresh Previdian and Patchstack telemetry showing pearcmd.php inclusion, arbitrary PHP file writes and 68 exploitation attempts. - [Hackers start exploiting critical WordPress flaw for code execution](https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/) — BleepingComputer · specialist/independent · 2026-09-23T00:00:00+12:00. Independent reporting on the shift from probing to file-writing exploitation attempts.