WordPress CVE-2026-87902 Exploited the Same Day It Was Patched: pearcmd.php Turned Into a Web Shell Dropper

TL;DR

• what: CVE-2026-87902 lets an unauthenticated attacker make WordPress get_page_template() include an arbitrary readable local .php file, and exploitation started within hours of the September 22 patch.
• impact: Where the theme and server preconditions line up, attackers chain the include with pearcmd.php to write PHP into /tmp and /var/tmp and load a web shell uploader, giving full code execution as the web server user.
• fix: Update to WordPress 7.1.2, 7.0.6, 6.9.9 or 6.8.10 now, then hunt for dropped PHP files in /tmp and /var/tmp.
• who: WordPress sites with auto-updates disabled or delayed, running a theme with a top-level page-* directory, on servers where pearcmd.php is present and readable (the default path in many PHP builds and container images).

WordPress shipped a fix for CVE-2026-87902 on September 22, 2026. The first exploitation attempt was recorded at 11:49 a.m. UTC that same day. The flaw carries a CVSS score of 9.2 and allows an unauthenticated attacker to reach remote code execution on sites where two preconditions are met. By September 25, CISA had added it to the Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to patch by September 28.

Auto-updates will close this on most WordPress installs without anyone touching them. The sites that stay exposed are the ones where auto-updates were turned off for change control, stability, or a managed host's own patch cadence. Those are often the business-critical ones.

What the Bug Does

According to the WordPress advisory, an unauthenticated attacker can make get_page_template() resolve a page template to a chosen readable local .php file outside the active theme directories. WordPress then includes that file. Local file inclusion of PHP is code execution if the attacker can find a file that does something useful when included, and PHP ships one.

Exploitation requires both of the following:

• The active child or parent theme contains a top-level directory whose name starts with page- (for example, page-templates). This is a common layout for themes that organize custom page templates.
• A local .php target file exists on the server and is readable by the web server account. The target seen in the wild is pearcmd.php, the PEAR command-line front end.

⚠️ Why pearcmd.php matters — pearcmd.php is a well-known local file inclusion gadget. When included through a web request, it can be driven to write attacker-controlled content to a file on disk. That turns a read-only include bug into arbitrary file write, and then into code execution. Observed requests targeted /usr/local/lib/php/pearcmd.php, the default location in many PHP builds, including common container images.

Observed Attack Chain

Previdian recorded 68 exploitation attempts against its honeypot network starting September 23, with traffic from a New Jersey IP address (104.194.9[.]227) and an Indonesia-based address. The requests follow a three-step pattern:

• Include /usr/local/lib/php/pearcmd.php through the vulnerable template resolution path.
• Use pearcmd.php to write a PHP file into /tmp/.
• Include that file, which pulls a PHP upload script from raw.githubusercontent[.]com/MrG3P5/web-shell/refs/heads/main/uploader.php, giving the attacker a persistent way to upload further payloads.

Patchstack independently saw the same progression: early reconnaissance that included harmless core files to confirm the bug, followed by active exploitation using pearcmd.php to write PHP to disk. Patchstack observed arbitrary file writes with attacker-controlled PHP content in both /tmp and /var/tmp.

Indicators of Compromise

File names observed in /tmp and /var/tmp:

wp-pear-rce-flag.php
poc87902.php
luci_.php
zeta_.php

Source IP addresses linked to exploitation:

104.194.9[.]227
43.250.53[.]42
180.251.159[.]243
195.178.110[.]247
107.189.14[.]87
45.61.184[.]170
92.246.130[.]76

Treat the IP list as short-lived. Mass exploitation campaigns rotate infrastructure quickly. The file names, the pearcmd.php request pattern and PHP files appearing in world-writable temp directories are the durable signals.

How Likely Is Compromise

Previdian founder and CEO Ryan Dewhurst expects mass exploitation attempts but relatively few actual compromises, because WordPress auto-updates are on by default and the preconditions narrow the target set. That assessment is reasonable at internet scale. It does not help an individual organization whose site happens to meet both conditions. A theme with a page-templates directory is routine, and pearcmd.php is present by default on a large share of PHP installs. If auto-updates are disabled on your site, assume you are in the exposed population until you verify otherwise.

Patched does not mean clean — Exploitation began before most manual patch cycles could run. A site patched on September 23 or later may already have a dropped PHP file or uploaded web shell. Updating WordPress removes the entry point, not anything the attacker left behind. Audit /tmp, /var/tmp and the web root after patching.

What to Do Now

• Update to WordPress 7.1.2, or the fixed release on your branch: 7.0.6, 6.9.9 or 6.8.10.
• Confirm auto-updates for core security releases are enabled, or that your host has applied the update.
• Check whether your active theme and parent theme contain a top-level page-* directory. This tells you whether you met the first precondition.
• Check whether pearcmd.php exists and is readable by the web server user. If PEAR is not used on the web host, remove read access to it or move it out of the PHP include path as defense in depth.
• Search /tmp and /var/tmp for .php files created on or after September 22 and review web server logs for requests referencing pearcmd.
• Look for outbound connections from PHP worker processes to raw.githubusercontent.com. A web server fetching code from GitHub is rarely legitimate.
• If you find a dropped file, treat the host as compromised: rotate WordPress admin, database and API credentials, and check for new admin users and modified plugin or theme files.

Federal agencies have until September 28. Everyone else should be on the same timeline or faster, since the exploit chain is public, simple and already automated.

Originally published on RedEye Threat Intelligence.