The critical WordPress flaw patched yesterday is no longer just a theoretical risk. Security firm Patchstack says attackers moved from scanning for vulnerable sites to actively exploiting the bug within about a day of the patch shipping.

What changed

The flaw, tracked as CVE-2026-87902, lets an attacker who isn’t logged in trick WordPress into loading a PHP file it shouldn’t. WordPress.org fixed it in version 7.1.2 on September 22.

According to Patchstack, the first attacker activity it observed, on September 22 at 11:49 UTC, was reconnaissance: requests probing harmless core files to check if a site was vulnerable. As of September 23, that has escalated. Attackers are now pulling in pearcmd.php, a file that ships with WordPress, and using it to write new PHP files directly onto the server. That’s an active attempt to plant code and take over the site, not just a test. Patchstack also says scanning tools built for this specific flaw are now circulating publicly, which typically means more attackers join in fast.

The flaw affects WordPress versions 4.7.0 through 7.1.1, close to a decade of releases. WordPress.org has shipped fixes for the currently supported branches: 7.1.2, 7.0.6, 6.9.9, and 6.8.10, along with a backport to 4.7.37 for sites still running the oldest supported line.

What to do

  1. If you haven’t updated yet, do it now. Go to your WordPress Dashboard, click Updates, then Update Now.
  2. Confirm you’re on 7.1.2, or on 7.0.6, 6.9.9, 6.8.10, or 4.7.37 if your site runs an older major version.
  3. If your host manages updates automatically, check that the update actually applied. Attackers are exploiting this within hours of a site being found vulnerable, so don’t assume it happened.
  4. If you use a web application firewall, ask your provider whether it has a rule for CVE-2026-87902 yet, since not every vendor ships protection on day one.

End of article