{
  "id": 15064279,
  "title": "CVE-2026-87902 Under Active Exploitation: 64 Honeypot Attempts and a GitHub-Hosted Webshell",
  "url": "https://urgent.news/2026/10/16/cve-2026-87902-under-active-exploitation-64-honeypot-attempts-and-a",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T23:01:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/cve-2026-87902-under-active-exploitation-64-honeypot-attempts-and-a-github-hosted-webshell-1ap5"
  },
  "original_language": "en",
  "account": "On September 21, 2026, the CVE-2026-87902 vulnerability in WordPress was found to be under active exploitation. This flaw, rated an 8.1 on the CVSS v3.1 scale, enables unauthenticated inclusion of a local PHP file and potentially leads to remote code execution. Detected by telemetry from Patchstack and BleepingComputer, the transition from disclosure to active attacks occurred within a single day of the patch. The vulnerability is exploited via a double-encoded traversal in the pagename parameter that escapes sanitisation and is later decoded by get_page_template(). If an active theme with the proper directory structure is present, PHP with register_argc_argv enabled allows for full code execution. The impact of the flaw has been demonstrated through 64 honeypot attempts originating from a single host in New Jersey, attempting to plant a remote web shell hosted on GitHub. Successful exploitation would grant the attacker interactive command execution as the web server user, granting access to configuration files and any data within the process's reach. The vulnerability affects WordPress releases prior to version 7.1.2, and the vendor has backported the fix across maintained branches. Sites with unpatched versions, affected themes, and permissive PHP configurations are at risk. Despite the vast number of assets associated with WordPress, the lack of corresponding CVE entries indicates that attack traffic is already circulating before per-CVE indexing catches up. To mitigate the risk, it is crucial to update to WordPress 7.1.2 or the backported release immediately and monitor for indicators of the described campaign, including traversal sequences in template parameters, outbound fetches to code-hosting domains, and newly written PHP files. If any indicators are present, credentials reachable by the PHP user should be rotated.",
  "summary": "CVE-2026-87902 Under Active Exploitation: 64 Honeypot Attempts and a GitHub-Hosted Webshell Vulnerability overview CVE-2026-87902 moved from disclosure to active attack traffic within roughly a day of its patch. The WordPress core flaw, fixed in 7.1.2 and rated 8.1 on CVSS v3.1, allows unauthenticated inclusion of a readable local PHP file and can escalate to remote code execution. Telemetry…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}