Urgent Alert: Critical WordPress Core Vulnerability CVE-2026-87902 Under Active Exploitation – What Businesses Need to Do

WordPress is the backbone of the modern web, powering over 40% of all websites globally. Because of its massive footprint, any vulnerability in its core software immediately becomes a prime target for cybercriminals. On September 22, 2026, the WordPress Security Team released an urgent security update addressing a critical vulnerability tracked as CVE-2026-87902. Alarmingly, security researchers have already confirmed that threat actors are actively exploiting this flaw in the wild, turning a theoretical risk into an immediate business threat.

Executive summary

• Vulnerability: CVE-2026-87902 (CVSS Score: 9.2 - Critical), affecting WordPress Core versions 4.7.0 through 7.1.1.
• Impact: Unauthenticated Path Traversal and Local File Inclusion (LFI), which can be escalated to Remote Code Execution (RCE) and complete server compromise under specific conditions.
• Status: Actively exploited in the wild. Malicious scanning and exploit attempts surged tenfold within hours of the patch release.
• Immediate Action: Upgrade to WordPress 7.1.2 or the corresponding backported security release for older branches immediately.

What happened?

On September 22, 2026, WordPress released version 7.1.2 to address a critical path traversal flaw discovered by security researcher Robert Ressl. Because of the severity of the issue, the security team also backported the fix to all older branches down to version 4.7. This means the vulnerability has existed silently in WordPress Core for nearly a decade, leaving millions of legacy and modern websites exposed. Within five hours of the patch release, security firms like Patchstack and Wordfence observed threat actors transitioning from basic reconnaissance to active exploitation, attempting to write malicious files to disk and execute arbitrary commands on vulnerable servers.

How the attack works at a high level

The flaw lies within the 'getpagetemplate()' function, which WordPress uses to resolve which template file should load a page. During this process, WordPress builds a template filename using the 'pagename' parameter directly from the URL without running it through proper validation checks (completely skipping the 'validate_file()' function designed to prevent directory traversal). Coupled with an earlier URL decoding step, an unauthenticated attacker can craft a malicious request to force the server to load an arbitrary PHP file outside the active theme directory. To escalate this local file inclusion (LFI) into full Remote Code Execution (RCE), two conditions must be met: the active theme must have a top-level directory starting with 'page-' (such as 'page-templates', common in themes like Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney), and the server must host a readable PHP file that can be abused (such as 'pearcmd.php', which is enabled by default in official PHP Docker images and default cPanel setups running PHP versions prior to 8.5).

Why this is a business risk

For any business, a website is more than just a digital brochure; it is a critical channel for customer engagement, lead generation, and brand reputation. A successful compromise via this WordPress vulnerability can have devastating consequences. Attackers can inject SEO spam to ruin your search engine rankings, steal sensitive customer data, deface your site, or use your server to launch further cyberattacks. The financial cost of incident response, data recovery, legal compliance penalties, and brand damage far outweighs the effort required to maintain a proactive security posture.

What businesses should do in the next 24–72 hours

• Identify and audit the WordPress versions of all digital assets managed by your organization.
• Upgrade immediately to WordPress 7.1.2. If you are running older versions due to legacy plugin compatibility, apply the corresponding backported security update (e.g., 7.0.6, 6.9.9, 6.8.10, etc.).
• Review your server configuration, especially if using cPanel or Docker, and disable the 'registerargcargv' setting in your PHP configuration if it is not strictly required.
• Ensure your Web Application Firewall (WAF) rules are fully updated and active to block malicious directory traversal payloads.
• Perform a complete backup of your website's files and database before applying any updates to prevent potential system conflicts.

Long-term lessons for CMS and digital infrastructure security

The rapid exploitation of CVE-2026-87902 highlights a fundamental truth in cybersecurity: security is an ongoing process, not a one-time setup. Organizations must implement robust patch management workflows, enabling automated security updates where feasible and conducting regular testing. Furthermore, adopting a defense-in-depth strategy—combining WAFs, real-time log monitoring, least-privilege server configurations, and routine security audits—is essential to minimizing the impact of zero-day vulnerabilities before patches can be deployed.

How Hanoi Byte can help

At Hanoi Byte, we understand that managing, securing, and scaling digital infrastructure can be overwhelming for growing businesses. As a trusted technology partner, we specialize in digital transformation, cloud optimization, custom software development, and robust security workflows. If your business relies on WordPress, a custom CMS, or cloud-based infrastructure but lacks a dedicated team to manage security audits and routine maintenance, Hanoi Byte can help. We work closely with you to assess risks, modernize your systems, and build a practical security roadmap tailored to your operational needs. Contact Hanoi Byte today to start a conversation about making your digital operations more secure, scalable, and resilient.