Attackers began targeting the critical WordPress vulnerability CVE-2026-87902 within hours of a patch being released. The flaw affects WordPress versions 4.7.0 through 7.1.1 and lets unauthenticated attackers include local PHP files via path traversal. When certain server and active theme conditions are met, this leads to remote code execution. Patchstack rates the CVSS score at 9.2.
How the Attack Works
The file pearcmd.php sits at the center of the campaign. Attacks run in stages: first, attackers send inclusion attempts against common core files to probe whether an instance is vulnerable. Next, they attempt to access pearcmd.php across three different directories on the host. In the final step, they use the config-create command to write arbitrary PHP content to files on the server, achieving code execution.
Files observed in attacks were dropped in /tmp and /var/tmp under names like wp-pear-rce-flag.php or poc87902.php. Because /tmp is not web-accessible, researchers treat this primarily as proof of code execution rather than a persistent backdoor. The same technique can, however, place files in web-accessible locations. User-agent strings in the attack traffic indicate that a public proof-of-concept and a Nuclei template are already circulating, significantly lowering the bar for attackers. Attack traffic has increased more than tenfold since the first evening.
What to Do
Update your WordPress installation to 7.1.2, 7.0.6, 6.9.9, or 6.8.10 immediately. Backports are available for all older branches down to version 4.7.37. If automatic updates are enabled, WordPress applies the fix on its own. Patchstack has also published indicators of compromise in their analysis, which you can use to determine whether a site has already been breached.