WordPress Patches Critical RCE in 7.1.2 as Attacks Hit Within 5 Hours

Q: What makes a legitimate PHP package the perfect accomplice for hackers exploiting this critical WordPress vulnerability?

The “perfect accomplice” is **pearcmd.php because it is a legitimate, commonly present PHP management tool that attackers can abuse to create a malicious PHP file on the server, then have WordPress load it through CVE-2026-87902**. That makes it unusually useful in this attack chain. The WordPress flaw on its own is a local file inclusion issue: it can be tricked into including a readable PHP file outside the active theme directory under certain theme and server conditions. To turn that into full remote code execution, attackers need a PHP file on disk that does something useful when included. `pearcmd.php` fits that role because it can be manipulated through request arguments to write attacker-controlled PHP content to locations such as `/tmp` or `/var/tmp`. Researchers say the chain works especially well on servers where `register_argc_argv` is enabled, a setting still common in some environments, including official PHP Docker images and older cPanel-based setups. In those cases, `pearcmd.php` can interpret crafted arguments from a web request and perform file-write actions such as `config-create`. Its legitimacy is what makes it dangerous. It is not malware, so defenders may overlook it, yet it is often already installed, readable by the web server, and trusted enough to blend into normal PHP environments. That removes a major hurdle for attackers: they do not need to upload a helper tool before exploiting the WordPress bug.

3 articles · Updated · Computerworld · Sep 24

WordPress 7.1.2 fixes CVE-2026-87902, a critical flaw that can let unauthenticated attackers execute code by forcing page template resolution to load a chosen local PHP file.
Patchstack said probing began in under five hours of the Sept. 22 release and exploitation followed the same day, with attack traffic rising roughly tenfold within a day.
Attackers are abusing pearcmd.php to write malicious PHP outside WordPress directories, then using the flaw to execute it—giving access to wp-config.php, credentials, admin creation and persistent backdoors.
The patch was backported to versions 4.7 through 7.1.1, widening the urgent update pool to nearly a decade of installs, including older enterprise deployments.
Security advisers said internet-facing WordPress systems now need hours-level, verified patching, while enterprises may stay exposed longer because change-control queues and forgotten microsites delay updates.