WordPress Issues Emergency Patch for Critical RCE Vulnerability as Attackers Strike Within Hours of Disclosure

The global cybersecurity community is on high alert following the release of an emergency security update from WordPress, designed to close a critical vulnerability that grants unauthenticated attackers the ability to execute remote code. The flaw is considered particularly dangerous not only because of its technical severity but because it arrives at a time when the window between the publication of a patch and the commencement of active exploitation has effectively vanished.

WordPress, which powers over 40% of the internet, has long been a primary target for threat actors. However, this latest vulnerability, tracked as CVE-2026-87902, represents a significant escalation in risk for both small-scale site owners and large enterprises. The bug allows for full Remote Code Execution (RCE), the "holy grail" for attackers, enabling them to take complete control over a target server without requiring any login credentials or prior authorization.

The discovery of the flaw is credited to Robert Ressl, a security researcher based in Switzerland, who reported the issue through responsible disclosure channels. In response, WordPress released version 7.1.2, while simultaneously backporting the fix to versions as old as 4.7. This broad backporting highlights the severity of the situation, as it indicates the vulnerability has existed within the WordPress core architecture for nearly a decade, leaving millions of legacy installations potentially exposed.

The Mechanics of the Attack

According to the official security release from WordPress, the vulnerability stems from an issue within the system’s page template resolution logic. Under specific conditions, an unauthenticated attacker can manipulate this logic to force the application to include a local PHP file located outside the active theme directories.

In the world of web security, this is often referred to as a Local File Inclusion (LFI) vulnerability that can be escalated to RCE. If the server environment and the active theme meet certain preconditions, the attacker can move from simply reading files to executing malicious scripts. The official WordPress advisory noted that the fix specifically addresses the way the platform handles template paths, ensuring that attackers cannot break out of designated directories to interact with sensitive system files.

Noah Kenney, a principal consultant at Digital 520, emphasized that the damage potential once an attacker achieves PHP execution cannot be overstated. "Once attackers have PHP execution, they can read the wp-config.php file, which is the heart of a WordPress installation," Kenney explained. "This allows them to obtain database credentials and authentication keys. From there, they can create new administrator accounts, alter payment or lead capture forms, redirect visitors to malicious sites, and install persistent backdoors that survive even after the initial entry point is closed."

Kenney also shed light on a sophisticated multi-stage attack vector currently being observed in the wild. Attackers are reportedly leveraging a legitimate PHP package management tool known as pearcmd.php. While not a part of WordPress itself, this tool is often present in the broader server environment.

"Attackers can abuse configuration commands in pearcmd.php to write content of their choosing to the disk," Kenney noted. "The current wave of attacks uses this tool to place malicious PHP code in the /tmp directory, and then uses the WordPress flaw to load and execute that specific file. This is a critical detail for defenders: a security team that is only monitoring the WordPress directory for changes could miss that first stage entirely, as the malicious file is written to a temporary system folder rather than the webroot."

New risk reality

While the technical details of the exploit are concerning, industry analysts from IDC and other security firms are more troubled by the speed at which threat actors have mobilized. The timeline of this incident suggests that the traditional "remediation cycle"—where organizations have days or weeks to test and deploy patches—is no longer a viable strategy for internet-facing assets.

Philip Harris, Research Director at IDC, described the situation as a "textbook example of the new risk reality." He pointed to data from the security firm Patchstack, which began recording attacker activity almost immediately after the patch was made public. "Attackers are exploiting critical bugs within hours of disclosure, and most enterprises are not patching fast enough to keep up," Harris said.

The telemetry provided by Patchstack illustrates a collapsing timeline for vulnerability management. Reconnaissance traffic—attackers probing sites to see if they were running vulnerable versions of WordPress—was detected within five hours of the 7.1.2 release. Within approximately 24 hours, the nature of the traffic shifted from harmless probing to full-scale exploitation attempts.

"The window between disclosure and exploitation has collapsed to the point that the mean time to exploit for critical vulnerabilities is now negative in some cases," Harris observed. "This means exploit code or scanning payloads appear before or immediately after a patch ships. Patchstack recorded the first probing traffic under five hours after the release, and the volume increased roughly tenfold within a day as attackers moved into actual payload delivery."

Aman Mahapatra, chief strategy officer for Tribeca Softech, echoed this sentiment, arguing that the industry needs to rethink how it measures risk. He suggested that the severity of a bug is no longer just about its CVSS score—which in this case is a near-maximum 9.2—but about the speed of the exploit.

"The number that should anchor this story is not the 9.2 CVSS score, but the gap between patch and exploit. With this vulnerability, that gap was effectively zero," Mahapatra said. "WordPress shipped the fix on September 22, and exploitation attempts were blocked the same day using payloads that matched the exact encoding the patch was written to fix. Attackers did not discover this bug through their own independent research; they read the fix. In the modern era, publishing a patch is functionally publishing an exploit guide."

Speedier patching needed

The immediate reaction to such a rapid threat is often a call for universal automated updates. However, for many enterprises, the solution is not that simple. The tension between the need for speed and the need for system stability remains a primary challenge for Chief Information Security Officers (CISOs).

The 2024 CrowdStrike incident, which saw a faulty update cause global IT outages, remains fresh in the minds of many executives. This has led to a renewed hesitancy toward "excessive patch automation." Many enterprise security teams insist on reviewing and testing any system changes in a staging environment before deploying them to production to avoid catastrophic downtime.

Robert Ressl, who discovered the vulnerability, noted that automation also brings a false sense of security if it is not accompanied by rigorous verification. "Having automatic updates enabled is not the same as verifying that the patch is actually installed and functioning," Ressl said in an interview. "Compatibility and availability concerns are legitimate reasons for testing updates, but those tests must happen at an accelerated pace. My recommendation is a rapid, tested rollout with verification across all exposed installations, including staging sites."

Mahapatra pointed out that this caution often creates a paradox where the most "mature" organizations are the most vulnerable. While a hobbyist blogger likely has default auto-updates enabled and was patched within minutes, large corporations often disable these features to enforce strict change control.

"Enterprise sites routinely disable auto-updates to maintain governance," Mahapatra explained. "This means the organizations with the most sophisticated processes are the ones most likely to still be exposed, because their own internal bureaucracy is holding the fix in a queue while attackers are already scanning their networks. A change control process that cannot distinguish between an unauthenticated RCE flaw and a routine plugin update is protecting the process rather than the enterprise. This vulnerability makes that lack of distinction very expensive."

Nidhi Luthra, an executive advisor for Acceligence, added that the "attacker roadmap" created by a patch release necessitates a paradigm shift. "Emergency patching for internet-facing systems needs an hours-level response," she said. "The luxury of a week-long testing cycle is gone."

Forgotten WordPress sites may not be patched

Perhaps the most significant hurdle for large organizations is the sheer scale of their "invisible" attack surface. Mahapatra noted that many enterprise WordPress deployments occur "below the radar." These sites are not necessarily "shadow IT" in the sense that they were built in secret; rather, they are authorized projects that have simply been forgotten by IT management over time.

"The exposure is materially larger than most organizations assume because most enterprises do not think of themselves as ‘WordPress shops,’ yet almost all of them are," Mahapatra said. "The risk sits in the web estate that IT never inventoried: marketing microsites, temporary campaign landing pages, regional country-specific sites, and investor relations pages often built by outside agencies. Furthermore, the properties of companies acquired years ago that were never fully migrated into the core infrastructure are major risks."

Because the affected version range for CVE-2026-87902 extends back to version 4.7.0, it covers nearly a decade of WordPress installations. These forgotten sites are exactly the ones most likely to be running on old, unpatched branches of the software.

This issue is particularly prevalent in the financial sector. "When I walk through external attack surface reviews with banking CISOs, the WordPress instances that surface are almost never the primary corporate site," Mahapatra observed. "They are sites belonging to a subsidiary, a marketing initiative, or an agency contract that expired years ago. None of them appear in the Configuration Management Database (CMDB) that the security team uses for patching. These abandoned sites become the perfect entry point for an attacker to gain a foothold in the corporate network."

As attackers continue to refine their payloads and scanning tools, the window for action is closing. Security experts agree that the only defense against this new generation of rapid exploitation is a combination of total asset visibility, accelerated testing cycles, and a willingness to prioritize critical security patches over standard administrative procedures.