Critical WordPress Flaw Under Active Attack Within Hours of Patch Release

WordPress has disclosed a critical vulnerability, CVE-2026-87902, with a CVSS score of 9.2, that allows an unauthenticated attacker to manipulate page-template resolution to include a chosen local PHP file. If certain server and theme conditions are met, this can lead to full remote code execution.

Security researchers at Previdian and Patchstack report that exploitation began within hours of the patch being released, with attackers abusing a local file called pearcmd.php to write malicious files to temporary directories, then pulling in a web shell hosted on GitHub. Dozens of exploitation attempts have already been logged, originating from IP addresses in the US and Indonesia, and activity has escalated from simple reconnaissance to active attempts to plant malicious code.

While the flaw is serious, experts note that specific preconditions must be met for exploitation to succeed, and because WordPress applies auto-updates by default, many sites may already be protected. Even so, administrators are urged to update immediately, as attackers are moving quickly to take advantage of unpatched systems.