Threat Type: Unauthenticated path traversal leading to local PHP file inclusion, with conditional remote code execution (CWE-98).

Severity: High.

CVE ID: CVE-2026-87902 (GHSA-7hp8-65ch-5whp).

CVSS: 8.1 High (v3.1, CISA-ADP score on NVD): CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• Vendor (CNA): 9.2 Critical (v4.0),CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. AT:P reflects the preconditions below. NVD lists no v4.0 score.

Affected Products: WordPress Core 4.7.0 through 7.1.1. NVD lists no lower version bound, and no source says whether releases before 4.7 are affected.

Fixed Versions: 7.1.2 and branch backports down to 4.7.37 (full list in Section 6.0).

Authentication: None required. No user interaction.

Exploit Status: Exploited in the wild, with a public proof of concept and public scanning tooling.

• Added to CISA KEV on September 25, 2026 (due September 28). CISA-ADP SSVC: exploitation active, automatable: no, technical impact: total.

• Patchstack observed first activity on September 22 at 11:49 UTC and the first file-write attempt at 15:34 UTC.

• Previdian honeypots recorded 3,056 attempts from 18 IPs between September 23 and October 5.

Root Cause: The template name built from the pagename request value was not checked with validate_file(), unlike a neighboring code path. The fix adds that check and a containment check on every resolved template path.

Preconditions for code execution:

• The active parent or child theme has a top-level page-directory, such as page-templates. A symlink works, and it need not be writable. SecurityWeek names Twenty Twelve,Twenty Fourteen, Neve, Hestia and Sydney as themes with this layout.

• A published Page is selectable by page_id, with no earlier valid assigned custom template.

• A readable local .php file exists to include. The observed chain uses PEAR's pearcmd.php.

• PHP runs with register_argc_argv On (default in official PHP Docker images and cPanel on PHP below 8.5, per Patchstack).

• PHP can write to a temporary directory.

Attack Chain/Method:

• Initial access: An unauthenticated GET or POST to / or /index.php carries an encoded traversal in pagename (single or double encoded, either hex case, one to twelve levels), usually prefixed with templates%2f, plus a valid page_id. WordPress reads pagename from the POST body before the query string, and POST is now more common than GET.

• Exploitation: WordPress decodes the value,builds page-{value}.php and includes a local PHP file outside the theme folders.

• Reconnaissance: Attackers include core files to confirm the site is vulnerable, most often wp-links-opml.php, also wp-includes/feed-rss2.php, wp-cron.php, wp-includes/functions.php, wp-login.php and install.php.

• Verification: Attackers include pearcmd.php with +config-show to confirm PEAR and register_argc_argv, trying /usr/local/lib/php/pearcmd.php, /usr/share/php/pearcmd.php and /usr/share/pear/pearcmd.php.

• Payload delivery: +config-create writes attacker controlled PHP to /tmp or /var/tmp. Some payloads write only a marker string (CVE-2026-87902-POC-OK or an obfuscated LUCIFER-RCE-OK); others write a short tag that runs a shell command when the file is accessed. Previdian also reports requests that write a file to /tmp and then include a PHP upload script hosted on GitHub (Section 5.0).

• Persistence and C2: Not confirmed. Files in /tmp are usually not web reachable, so activity so far shows execution rather than a persistent backdoor, though the same write primitive could target other locations. Previdian reports two callback hosts but does not publish them in its public content.

• Post-exploitation: Not reported beyond the GitHub-hosted upload script. Code runs with the web server account's privileges.