Clarissa Hana
Threat actors have escalated their activities from merely probing WordPress websites vulnerable to CVE-2026-87902, a critical unauthenticated path traversal bug, to actively exploiting the flaw for remote code execution (RCE). This shift signifies a dangerous progression, moving beyond reconnaissance to the deployment of malicious payloads that can compromise website integrity and user data. The vulnerability, discovered by security researcher Robert Ressl, was patched by WordPress in version 7.1.2, released on September 22nd, and subsequently backported to older branches due to its severity. However, the rapid transition from detection to exploitation underscores the persistent threat posed by unpatched systems in the vast WordPress ecosystem.
Escalation from Probing to Exploitation: A Rapid Threat Response
The initial stages of the attack campaign, observed by WordPress security firm Patchstack, commenced with reconnaissance less than five hours after the patch for CVE-2026-87902 was made available. Threat actors, originating from a small cluster of IP addresses, began sending malicious requests to multiple WordPress sites under Patchstack’s protection. These early probes were designed to identify vulnerable systems by attempting to include standard WordPress core files, a common tactic to gauge the presence of exploitable weaknesses.
However, the landscape of the attack shifted dramatically within a short period. By September 23rd, Patchstack reported a tenfold increase in malicious activity related to the vulnerability. This surge in traffic indicated a transition from passive scanning to active exploitation, with attackers now actively attempting to deliver payloads capable of executing arbitrary code on compromised servers. This swift escalation highlights the efficiency and proactivity of cybercriminal operations, which are adept at capitalizing on newly discovered vulnerabilities before widespread patching can occur.
Understanding CVE-2026-87902: The Technical Details of the Vulnerability
The criticality of CVE-2026-87902 stems from its nature as an unauthenticated path traversal bug. This means that an attacker, without needing any prior authentication or privileges on the WordPress site, can manipulate requests to trick the get_page_template() function into resolving to a chosen readable local PHP file outside of the active theme directories. This capability is particularly dangerous because it can be leveraged to achieve Remote Code Execution (RCE) under specific, albeit achievable, conditions.
The WordPress security team has assigned CVE-2026-87902 a critical severity score of 9.2 out of 10, reflecting the significant risk it poses. The official advisory details that the vulnerability allows an "unauthenticated attacker to make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories." This mechanism allows attackers to bypass intended file access restrictions.
For RCE to be fully realized, certain prerequisites must be met. While the original advisory did not explicitly detail these conditions in the provided text, typical RCE scenarios involving path traversal often require the attacker to be able to influence specific input parameters that are then used to construct file paths. The advisory does, however, explicitly mention that the official PHP image for Docker is affected, as is the default cPanel configuration when a PHP version prior to 8.5 is in use. This points to specific environmental factors that can exacerbate the vulnerability.
The Exploitation Chain: From File Inclusion to Shell Commands
The advanced exploitation observed by Patchstack involves a multi-stage process. Following the initial reconnaissance, attackers moved to a more sophisticated attack vector. The "third stage," as described by Patchstack, involves swapping a command like config-show for config-create. This is significant because pearcmd, a command-line interface for the PHP Extension and Application Repository (PEAR), can be manipulated to write files to arbitrary locations on the server with content controlled by the attacker.
The payloads observed in this exploitation phase vary in their immediate impact. Some attackers are simply writing a string to the compromised host, serving as a flag to indicate that the system has been successfully exploited via CVE-2026-87902. This could be a precursor to a more widespread campaign or a way to mark targets for later exploitation. More concerningly, researchers have identified payloads that "write a short tag that executes a shell command on access." This directly leads to arbitrary code execution, allowing attackers to control the compromised server.
The files created by these malicious payloads are typically placed in temporary directories like /tmp and /var/tmp. These files are often given names that suggest their purpose, such as wp-pear-rce-flag.php, poc87902.php, or randomized names like luci_<random>.php and zeta_<random>.php. The use of temporary directories is a common tactic to avoid detection and to execute commands without leaving easily traceable, permanent artifacts in core WordPress directories.
Patchstack’s analysis also provided insights into the specific techniques used in the probes. While a full working request example was not disclosed, it was noted that the observed probes employed double-encoded traversal sequences within the pagename parameter, in conjunction with a valid page_id parameter. This sophisticated encoding is likely an attempt to evade signature-based detection systems that might otherwise flag simpler traversal attempts.
Timeline of the Threat: From Discovery to Active Exploitation
The timeline of events surrounding CVE-2026-87902 illustrates a critical vulnerability lifecycle:
- Discovery: Security researcher Robert Ressl identifies the unauthenticated path traversal bug.
- Patch Development: The WordPress security team develops a patch to address the vulnerability.
- Patch Release: WordPress version 7.1.2 is released on September 22nd, containing the fix for CVE-2026-87902. Fixes are also backported to branches 4.7 through 7.1.
- Initial Reconnaissance: Less than five hours after the patch release, a small group of IP addresses begins probing WordPress sites for the vulnerability. This activity is observed by Patchstack starting at 17:44 UTC on September 22nd.
- Increased Malicious Activity: Within 24 hours of the initial probes, malicious traffic related to CVE-2026-87902 increases tenfold.
- Active Exploitation: Attackers transition from reconnaissance to actively delivering payloads, including those designed to execute shell commands upon access.
This compressed timeline from patch release to active exploitation underscores the urgency with which website administrators must act to secure their systems. The speed at which attackers adapt and exploit newly disclosed vulnerabilities is a constant challenge in the cybersecurity landscape.
Affected Environments and Mitigation Strategies
The WordPress advisory specifically points to the official PHP image for Docker and default cPanel configurations using PHP versions prior to 8.5 as being susceptible. This information is crucial for system administrators managing these environments. The fact that fixes were backported to WordPress branches down to 4.7 indicates the broad impact of this vulnerability across a significant portion of the WordPress user base. However, releases prior to version 4.6 will not receive a patch, leaving older, unsupported installations at permanent risk.
The primary and most critical mitigation strategy for website administrators is to update their WordPress installations to version 7.1.2 or a later version. For those unable to update immediately, or for systems running older, unsupported versions, other security measures become paramount. This includes implementing robust Web Application Firewalls (WAFs) that can detect and block malicious traversal attempts, and closely monitoring server logs for suspicious activity, particularly requests targeting the get_page_template() function or exhibiting unusual traversal patterns.
Patchstack has also provided a list of IP addresses that should be considered for blocklisting due to their involvement in the observed reconnaissance and exploitation activities: 169.58.48.193, 169.58.48.195, and the IPv6 address 2001:df1:e8c0::106b. While blocking specific IPs is a reactive measure, it can provide immediate, albeit temporary, protection against known malicious sources.
Broader Implications and the Ongoing Cybersecurity Battle
The active exploitation of CVE-2026-87902 serves as a stark reminder of the persistent threats facing the global WordPress ecosystem, which powers an estimated 40% of all websites. The ease with which an unauthenticated attacker can gain a foothold for code execution underscores the importance of timely patching and proactive security.
The implications of successful exploitation are far-reaching. Compromised WordPress sites can be used for a variety of malicious purposes, including:
- Website Defacement: Altering the appearance and content of legitimate websites to spread misinformation or damage reputation.
- Malware Distribution: Hosting and distributing malicious software to unsuspecting visitors.
- Phishing Campaigns: Using compromised sites as landing pages for phishing attacks to steal credentials.
- Cryptojacking: Utilizing the server’s resources to mine cryptocurrency without the owner’s consent.
- Botnet Enlistment: Incorporating the compromised server into a botnet for distributed denial-of-service (DDoS) attacks or other coordinated malicious activities.
- Data Theft: Accessing and exfiltrating sensitive user data, customer information, or proprietary business data stored on the server.
The rapid response by threat actors to exploit CVE-2026-87902 highlights the maturity of the cybercriminal underground. Tools and exploits for newly disclosed vulnerabilities are often developed and weaponized within hours or days, making it imperative for organizations to have robust vulnerability management programs in place. This includes not only timely patching but also continuous security monitoring and incident response capabilities.
The WordPress community, with its vast user base, faces a perpetual challenge in ensuring widespread adoption of security updates. While WordPress core itself is actively maintained and secured, the reliance on third-party themes and plugins, along with the varying technical expertise of website administrators, creates a complex attack surface. This incident reinforces the need for ongoing education and awareness campaigns regarding the critical importance of maintaining up-to-date software across the entire WordPress stack. As artificial intelligence continues to evolve, the speed and sophistication of cyberattacks are only expected to increase, making proactive security measures more vital than ever.
