CVE-2026-87902: WordPress Flaw Under Active Attack
CVE-2026-87902 WordPress 7.1.2 flaw rated 8.1 CVSS sees active attacks as honeypots detect GitHub-hosted webshell planting attempts.
Stock photo for illustration only, not from the actual event
- CVE-2026-87902 flaw with an 8.1 severity score is actively exploited shortly after patching
- Honeypot sensors logged 64 attack attempts originating from a single host in New Jersey
- Attackers attempted to deploy a remote webshell hosted on GitHub via pagename parameters
- Administrators must update WordPress to version 7.1.2 or the backported release immediately
The security vulnerability designated as CVE-2026-87902 within the WordPress core has transitioned rapidly from disclosure to active attack traffic within roughly a day of its patch release. Addressed in version 7.1.2 with a CVSS v3.1 severity rating of 8.1, the flaw permits unauthenticated inclusion of readable local PHP files and can escalate to remote code execution. Telemetry data reported by Patchstack and BleepingComputer highlights how swiftly this operational transition occurred.
The exploitation mechanism relies on a double-encoded traversal sequence within the pagename parameter that bypasses early sanitization efforts and is decoded by get_page_template(). The template loader accepts candidate files located outside active theme directories provided they exist, remain readable, and conclude with a .php or .html extension. Furthermore, full code execution demands an active theme featuring a top-level page directory along with the commonly described route requiring PHP to have register_argc_argv enabled to leverage pearcmd.php.
Reported intrusion activity indicates that the vulnerability was leveraged to plant a remote webshell hosted directly on GitHub. Honeypot sensors deployed across the Previdian network logged 64 distinct attack attempts originating from a single host situated in New Jersey. This operational pattern aligns with opportunistic scanning followed by payload delivery targeting the initial responsive endpoint. A successful installation grants operators interactive command execution privileges as the web server user, allowing access to configuration files and any accessible data.
Stock photo for illustration only, not from the actual event
The swift weaponization of a critical vulnerability within a single day of patch publication underscores how modern threat actors utilize patch diffing techniques. Security researchers and malicious groups alike rapidly analyze security updates to reverse-engineer flaws and automate exploitation scripts targeting unpatched deployments. This dynamic emphasizes the vital necessity for organizations to apply security patches immediately upon release.
WordPress installations running versions below 7.1.2 remain affected, prompting the vendor to backport the fix across all maintained release branches. Sites facing the highest risk combine unpatched core versions alongside vulnerable themes and permissive PHP configurations. The documented campaign pursued a broad reconnaissance approach rather than targeting a specific industry vertical, indicating that small and mid-sized deployments face exposure equal to larger enterprise environments.
At the time of writing, ZoomEye queries return 7,991,549 assets matching app="WordPress" while recording zero results for vul.cve="CVE-2026-87902". This disparity between a massive product fingerprint and an empty vulnerability fingerprint reflects indexing lag rather than low exposure, illustrating conclusively that malicious traffic circulates well before CVE-specific indexing completes.
Operators should upgrade deployments to version 7.1.2 or the respective backported release for their installed branch without delay. Subsequently, administrators should audit environments for campaign indicators including traversal sequences in template parameters, outbound web server connections to code-hosting domains, and newly created PHP files. Credentials reachable by the PHP user ought to be rotated immediately if any suspicious indicators surface.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment