WordPress CVE-2026-87902: Probing and PHP File-Write Attempts Observed on Patch Day

On September 22, 2026, the WordPress core was found to have a critical path traversal vulnerability that could lead to local file inclusion (LFI) and potentially unauthenticated remote code execution (RCE). This vulnerability, identified as CVE-2026-87902, allows attackers to send requests that attempt to write PHP files to directories like /tmp or /var/tmp. The report from Patchstack noted a surge in such requests immediately after the patch was published.

As soon as an attacker identifies a directory starting with "page-" under an active theme or its parent theme, they can exploit the system by crafting requests with pagename parameters containing encoded path traversal sequences like %2e%2e or %252e%252e. These requests often involve the existence of pearcmd.php and the enablement of register_argc_argv. Once a PHP file is successfully written in the target directory, the attacker can execute it to achieve code execution.

However, there are several conditions that must be met for a successful attack. The web server must have read permissions to the readable PHP files outside the theme directories, and file write permissions must be available at the destination. Therefore, applying the patch and restricting directory permissions can mitigate the risk effectively.