What Happened
WordPress CVE-2026-87902 is under active exploitation. The flaw is an unauthenticated path traversal bug in WordPress core, rated 9.2 by the WordPress security team. It lets an attacker force page-template resolution to include a readable local PHP file outside the active theme. Under specific conditions, the result is remote code execution. WordPress fixed the bug in version 7.1.2 on September 22 and backported the fix to every branch down to 4.7.
Patchstack saw the first malicious requests less than five hours after the release. Traffic has since grown tenfold. Attackers now abuse pearcmd.php to write files into /tmp and /var/tmp, including files executing shell commands on access. The advisory names the official PHP Docker image and the default cPanel setup on PHP versions before 8.5 as affected configurations. Read the full report from BleepingComputer.
Why This Matters for Canadian Organizations
WordPress runs a large share of Canadian websites, from small businesses and non-profits to municipalities, school boards, and provincial agencies. Many of these sites sit on shared cPanel hosting, one of the exact configurations named in the advisory. This is a core flaw, not a plugin flaw. Every WordPress site needs the update, including sites with no plugins at all.
The five-hour gap between patch and first probe matters most. Monthly patch cycles do not survive this pace. A compromised site hosting a web shell exposes form submissions, customer records, and admin credentials. For private-sector organizations, a breach creating a real risk of significant harm triggers PIPEDA reporting duties to the Privacy Commissioner. Public bodies face parallel provincial obligations.
What to Do
Confirm every WordPress site runs 7.1.2 or the patched release for its branch. Sites older than 4.7 receive no fix and need a full upgrade. Check whether automatic core updates ran, then verify the version by hand. Search /tmp and /var/tmp for files named poc87902.php, wp-pear-rce-flag.php, luci_ or zeta_ followed by random characters. Block the source IPs Patchstack published. Disable register_argc_argv in PHP where your hosting allows it, and ask your host to confirm its PHP version.
Track related vulnerability coverage in our TechTalk section and daily updates in News.
