The Php Times

WordPress published two security updates on Tuesday. Patchstack reported initial probing of the second update, WordPress 7.1.2, within a few hours. By Wednesday, attackers were targeting pearcmd.php to write PHP files to servers. They were also running known scanners for CVE-2026-87902, which Patchstack rates at CVSS 9.2 and classifies as critical.

The vulnerability is a path-traversal flaw that allows unauthenticated attackers to include local PHP files. Code execution requires specific conditions on the server and in the active theme. Affected releases range from WordPress 4.7.0 through 7.1.1. Fixed versions are 7.1.2, 7.0.6, 6.9.9 and 6.8.10, with backports available for older branches down to 4.7.37. Administrators should update promptly. WordPress can install the fix automatically when automatic updates are enabled.

Patchstack measured more than a tenfold increase in vulnerability traffic during the first evening. The campaign begins with requests for ordinary core files, whose responses reveal whether an installation is vulnerable. A later stage accesses pearcmd.php in three directories on the host. The final stage uses its config-create command to turn file access into file writing.

The attackers have written PHP code to arbitrary files. Observed locations include /tmp and /var/tmp, with names such as wp-pear-rce-flag.php, poc87902.php, luci_<random>.php and zeta_<random>.php. Patchstack treats these files as evidence of code execution, since /tmp is usually unreachable from the internet. Attackers can also write to internet-accessible locations, so the host should be considered fully compromised. User-Agent data indicates that public proof-of-concept code and a Nuclei scanner template are circulating. Patchstack’s analysis contains indicators of compromise for checks on affected installations.