Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.
The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).
"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories," WordPress said in an advisory released two days ago. "If relevant preconditions for both the server environment and the active theme are met, this can lead to RCE."
In a statement shared with The Hacker News, Previdian said it's seeing exploitation attempts targeting CVE-2026-87902 against its honeypot network, with the malicious requests originating from an IP address (104.194.9[.]227) located in the U.S. state of New Jersey.
These requests include the local PHP file /usr/local/lib/php/pearcmd.php, writing a file to /tmp/, and then including a PHP upload script hosted on GitHub ("raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php").
"Although this is undoubtedly a serious vulnerability, certain preconditions make exploitation less likely," Previdian's founder and CEO Ryan Dewhurst said. "Because WordPress has auto-updates enabled by default, we're likely to see mass-exploitation attempts, but relatively few actual compromises."
Telemetry data from Previdian has recorded a total of 68 exploitation attempts starting September 23, 2026. Some of the efforts have also originated from an Indonesia-based IP address.
php" and use it to write PHP files to disk, corroborating findings from Previdian.
Source link
