WordPress Issues Emergency Patch for Critical RCE Vulnerability as Attackers Strike Within Hours of Disclosure

The global cybersecurity community is on high alert following the release of an emergency security update from WordPress, designed to close a critical vulnerability that grants unauthenticated attackers the ability to execute remote code. The flaw is considered particularly dangerous not only because of its technical severity but because it arrives at a time when the window between the publication of a patch and the commencement of active exploitation has effectively vanished.

WordPress, which powers over 40% of the internet, has long been a primary target for threat actors. However, this latest vulnerability, tracked as CVE-2026-87902, represents a significant escalation in risk for both small-scale site owners and large enterprises. The bug allows for full Remote Code Execution (RCE), the "holy grail" for attackers, enabling them to take complete control over a target server without requiring any login credentials or prior authorization.

The discovery of the flaw is credited to Robert Ressl, a security researcher based in Switzerland, who reported the issue through responsible disclosure channels. In response, WordPress released version 7.1.2, while simultaneously backporting the fix to versions as old as 4.7. This broad backporting highlights the severity of the situation, as it indicates the vulnerability has existed within the WordPress core architecture for nearly a decade, leaving millions of legacy installations potentially exposed.

The Mechanics of the Attack

According to the official security release from WordPress, the vulnerability stems from an issue within the system’s page template resolution logic. Under specific conditions, an unauthenticated attacker can manipulate this logic to force the application to include a local PHP file located outside the active theme directories.

In the world of web security, this is often referred to as a Local File Inclusion (LFI) vulnerability that can be escalated to RCE. If the server environment and the active theme meet certain preconditions, the attacker can move from simply reading files to executing malicious scripts. The official WordPress advisory noted that the fix specifically addresses the way the platform handles template paths, ensuring that attackers cannot break out of designated directories to interact with sensitive system files.

Noah Kenney, a principal consultant at Digital 520, emphasized that the damage potential once an attacker achieves PHP execution cannot be overstated. "Once attackers have PHP execution, they can read the wp-config.php file, which is the heart of a WordPress installation," Kenney explained. "This allows them to obtain database credentials and authentication keys. From there, they can create new administrator accounts, alter payment or lead capture forms, redirect visitors to malicious sites, and install persistent backdoors that survive even after the initial entry point is closed."

Kenney also shed light on a sophisticated multi-stage attack vector currently being observed in the wild. Attackers are reportedly leveraging a legitimate PHP package management tool known as pearcmd.php. While not a part of WordPress itself, this tool is often present in the broader server environment.

"Attackers can abuse configuration commands in pearcmd.php to write content of their choosing to the disk," Kenney noted. "The current wave of attacks uses this tool to place malicious PHP code in the /tmp directory, and then uses the WordPress flaw to load and execute that specific file. This is a critical detail for defenders: a security team that is only monitoring the WordPress directory for changes could miss that first stage entirely, as the malicious file is written to a temporary system folder rather than the webroot."

New risk reality

While the technical details of the exploit are concerning, industry analysts from IDC and other security firms are more troubled by the speed at which threat actors have mobilized. The timeline of this incident suggests that the traditional "remediation cycle"—where organizations have days or weeks to test and deploy patches—is no longer a viable strategy for internet-facing assets.