Attackers Exploit WordPress CVE-2026-87902 Within Hours of Patch

What it is

CVE-2026-87902 (CVSS 9.2), the unauthenticated WordPress RCE via get_page_template() template resolution, is under active exploitation. The summary has the mechanism, the patch versions, and the KEV listing — what the page adds is the concrete indicators for hunting: specific source IPs, dropped filenames, the exact pearcmd.php path, and the hosted payload URL.

Preconditions / Affected

Two conditions must both hold (as the summary notes): the active child or parent theme has a top-level directory whose name starts with page- (e.g. page-templates), AND a readable local .php file exists that the web server account can read — attackers target pearcmd.php at /usr/local/lib/php/pearcmd.php.

What to do

Patch to WordPress 7.1.2, 7.0.6, 6.9.9, or 6.8.10, then audit for compromise using these page-supplied IOCs.

Dropped web-shell filenames observed in /tmp and /var/tmp:

• wp-pear-rce-flag.php
• poc87902.php
• luci_<random>.php
• zeta_<random>.php

Hosted uploader payload pulled during exploitation:

raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php

Source IPs linked to the attacks:

104.194.9[.]227   (New Jersey, US)
43.250.53[.]42
180.251.159[.]243
195.178.110[.]247
107.189.14[.]87
45.61.184[.]170
92.246.130[.]76

Some activity also originated from an Indonesia-based IP. Check for arbitrary PHP writes into /tmp and /var/tmp, and for requests referencing pearcmd.php.

Caveats

Previdian recorded 68 exploitation attempts starting September 23, 2026, with the first effort at 11:49 a.m. UTC on September 22 — the same day patches shipped. Previdian's CEO Ryan Dewhurst assesses that despite likely mass-exploitation, actual compromises will be "relatively few" because WordPress auto-updates are enabled by default and the two theme/server preconditions narrow the exploitable population. Patchstack corroborates the shift from reconnaissance against harmless core files to active pearcmd.php-based file writes.