461.25.09.26- Critical WordPress Vulnerability CVE-2026-87902

Severity: Critical
CVSS Score: 9.2
Affected Product: WordPress Core
Affected Versions: WordPress 4.7.0 through 7.1.1

Overview

TT-CSIRT is advising organizations using WordPress to urgently apply security updates for CVE-2026-87902, a critical WordPress Core vulnerability that allows attackers to access unintended PHP files and achieve remote code execution. Exploitation has also been observed using public scanning and proof-of-concept tools increasing the risk of automated attacks against vulnerable internet-facing WordPress sites.

Impact

• access files outside of the intended WordPress theme directory
• execute malicious PHP code
• modify or compromise website content
• access sensitive information or credentials
• establish persistence on the affected server
• use the compromised system to support further malicious activity.

Indicators of Potential Exploitation

• Suspicious directory traversal patterns in pagename parameters, including encoded values such as %2e%2e or %252e%252e.
• References to pearcmd.php, config-show, or config-create.
• Unusual requests targeting /index.php or the website root.
• Unexpected PHP files in writable directories such as /tmp or /var/tmp.
• Monitor for variations in request methods, encoding, and user-agent strings, rather than relying only on IP addresses or a single exploit pattern.

Recommended Actions

• Update WordPress immediately to version 7.1.2 or the applicable patched release.
• Confirm automatic security updates were successfully applied.
• Review web server, WAF, and application logs for suspicious activity.
• Inspect WordPress and writable directories for unexpected PHP files or artefacts.
• Apply temporary WAF/web server rules to block directory traversal attempts.
• Enforce least privilege for web server and PHP service accounts.
• Maintain secure backups and verify restoration procedures.
• If compromise is suspected, isolate the system, preserve logs, investigate, and remediate before restoring service.

TT-CSIRT strongly recommends that organizations prioritize patching and immediately review affected systems for signs of compromise.

References

• WordPress 7.1.2 Security Release
• Patchstack – CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
• Tech Insider – WordPress CVE-2026-87902 Exploited Hours After Disclosure
• Help Net Security – WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)