Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Threat actors are actively exploiting CVE-2026-87902, a critical vulnerability in WordPress that allows unauthenticated remote code execution (RCE) under specific conditions. Exploitation requires the active theme to have a directory starting with 'page-' and a readable local PHP file such as 'pearcmd.php' on the server. Attackers are leveraging the vulnerability to write PHP web shells to temporary directories and are retrieving payloads from a GitHub repository. Multiple IP addresses have been observed conducting exploitation attempts, with the first recorded just hours after the patch was released.

AI-extracted · verify before operational use