WordPress Remote Code Execution Attacks Escalate From Scanning To Payload Delivery
VTA-2026-000363, published on 2026-09-24, covered CVE-2026-87902, the unauthenticated path traversal and remote code execution flaw in WordPress core fixed in the 7.1.2 security release. This update is issued because the attacker activity around it has changed character rather than because the underlying flaw has. At the time of the first advisory the observed traffic was reconnaissance aimed at harmless core files; that is no longer the case. Attackers are now including pearcmd.php in their requests and using it to write PHP files to disk, and public scanning tooling for this CVE is in circulation. Traffic volume rose roughly tenfold within a day of the patch as activity moved from scanning to genuine payload delivery, and the fix remains backported through version 4.7, so the exposed population includes a long tail of older installations as well as current ones.
The flaw itself is unchanged: under certain conditions an unauthenticated attacker can make page template resolution include a chosen readable local PHP file from outside the active theme directories, and where the preconditions of both the server environment and the active theme are met, that becomes remote code execution. What is new is the reliable second stage attackers have settled on. Pearcmd.php is a legitimate PHP package management tool that ships on many hosts, and its configuration commands can be abused to write attacker-chosen content to disk. The current campaigns use it to place malicious PHP under /tmp, then use the WordPress template resolution flaw to load and execute that file. The first blocked exploitation attempt was recorded at 11:49 UTC on 22 September, the same day 7.1.2 shipped, using payloads matching the exact encoding the patch was written to correct, with the first probing traffic seen under five hours after release.
The practical consequence of this two-stage chain is a detection blind spot. The initial write lands in /tmp rather than in the web root, so a security team monitoring only the WordPress directory tree for file changes can miss the first stage entirely and see nothing until execution has already occurred. Once PHP execution is achieved, the reachable damage is broad: reading wp-config.php yields database credentials and authentication keys, and attackers can create administrator accounts, alter payment or lead capture forms, redirect visitors and install persistent code. Exposure is also skewed in an unintuitive direction. WordPress applies minor security releases automatically by default, so many small sites were patched without intervention, while enterprise deployments that disable auto-updates to enforce change control are the ones most likely to still be sitting on a vulnerable version while scanning continues. Having automatic updates enabled is also not the same as having verified that the update actually landed, and staging and secondary installations are frequently missed in that verification. The flaw carries a CVSS score of 9.2, and FIRST EPSS currently models a 2.9% probability of exploitation activity in the next 30 days; that modelled figure describes internet-wide likelihood and does not displace the exploitation attempts already observed and blocked in the hours after the patch shipped.
Attack Surface
Content Management System, Web Application
Tactics
Reconnaissance, Initial Access, Execution, Persistence, Credential Access
Techniques
- T1595.002 – Active Scanning: Vulnerability Scanning
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1505.003 – Server Software Component: Web Shell
- T1136.001 – Create Account: Local Account
- T1552.001 – Unsecured Credentials: Credentials In Files
SuperPRO's Threat Countermeasures Procedures
- Confirm, do not assume, that WordPress 7.1.2 or the backported fix for CVE-2026-87902 is actually running on every installation, including staging, development and secondary sites; check the reported core version on each host rather than relying on auto-update being switched on.
- Extend file integrity monitoring beyond the WordPress web root to /tmp and other world-writable paths, and alert on newly created .php files there, since the current attacks write the payload to /tmp before the template resolution flaw loads it.
- Remove or restrict read access to pearcmd.php (commonly /usr/share/php/pearcmd.php) on hosts that do not require PEAR, breaking the stage that writes attacker-chosen PHP to disk under /tmp.
- Block or alert on HTTP requests to WordPress that contain pearcmd or traversal-encoded paths in page or template parameters; payloads observed in the wild matched the exact encoding the 7.1.2 patch was written to correct, and public scanning tooling for this CVE is now in circulation.
- Review wp_users and wp_usermeta for administrator accounts created since 22 September 2026, and audit theme and plugin files, payment forms and lead capture forms for injected redirects or unexpected PHP.
- On any site showing signs of exploitation, rotate the database credentials and regenerate the authentication keys and salts in wp-config.php, since that file is the first target once PHP execution is obtained.
- Define a change control exception path that treats unauthenticated remote code execution in internet-facing CMS core as an emergency release rather than a scheduled one, and record the verification result for each site so that queued fixes are visible.
