CISA has added a WordPress core flaw to its Known Exploited Vulnerabilities catalog after attackers moved from testing page-template handling to attempting to plant PHP files. The September 25 listing makes CVE-2026-87902 an active-exploitation priority. Site owners should install WordPress 7.1.2 or the fixed release for their branch, then investigate any exposure before the update.[1]
The important distinction is that this is a flaw in the website server, not a warning that every visitor’s computer is infected. Exploitation depends on the active theme and PHP environment; the version number alone does not establish that a particular site was compromised.
From a normal page request to a PHP file
WordPress normally chooses a theme template when it renders a page. Its security advisory describes a path-traversal error in get_page_template(): an unauthenticated request can steer that selection toward a readable local PHP file outside the theme directories. “Local” describes where the file resides; the attacker can send the request over the network.[2]
Two conditions matter. The active parent or child theme must contain a top-level directory beginning with page-, and a suitable PHP target must be present and readable. The advisory names Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as examples of affected themes. A route through PEAR’s pearcmd.php can turn inclusion into code execution when PHP’s register_argc_argv setting is enabled. These conditions explain the risk; they are not a reason to leave an available core patch uninstalled.
The requests changed within a day
Patchstack first observed attempts at 11:49 UTC on September 22. Its September 23 update describes three stages: including ordinary core files to test the weakness, checking whether PEAR was reachable, and attempting to write attacker-controlled PHP. Some payloads produced test markers; others were designed to run shell commands. This is observed attack traffic, not a published count of successfully compromised sites.[3]
One revealing detail is the pairing of page_id with pagename. A real page had to resolve before the vulnerable template path was reached. The researchers also saw POST requests, so a review limited to GET query strings can miss relevant evidence. Unexpected PHP files in /tmp or /var/tmp deserve investigation: a temporary file is not necessarily a persistent, web-accessible backdoor, but it can show that an attacker reached the write stage.
Update the core, then check what preceded the patch
WordPress released 7.1.2 on September 22. The update is available through Dashboard → Updates.[4] The security advisory also lists backports, including 7.0.6, 6.9.9 and 6.8.10, down to 4.7.37. Match the installed branch to its fixed release rather than assuming that a July or August update covers this September flaw.
For a managed site, ask the host to confirm the installed core version and the time it was patched. If the site was exposed, preserve web-server and WAF logs before cleanup and have the administrator correlate suspicious requests with responses and file changes. An attempted request, a successful inclusion and a successful file write are different findings.
A web application firewall can help filter malicious requests while a patch is deployed. It does not remove files or changes left by an earlier intrusion. Likewise, a suspicious redirect warrants investigation, but does not identify this vulnerability as its cause; compromised websites can support several kinds of phishing abuse.
The practical goal is twofold: close the vulnerable template path and establish whether it was used before that happened. A successful update answers the first question; server evidence answers the second.
References
- CISA. Known Exploited Vulnerabilities Catalog, CVE-2026-87902; added September 25, 2026, accessed September 27, 2026. Official catalog data.
- WordPress Security Team. Unauthenticated path traversal in page-template resolution leading to conditional RCE. GitHub advisory, September 22, 2026. Conditions and fixed versions.
- Dave Jong. CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch. Patchstack, September 22, updated September 23, 2026. Observed attack stages.
- WordPress.org. Version 7.1.2. September 22, 2026, accessed September 27, 2026. Release and update instructions.
