Executive Summary: Emergency Core Patching for Global CMS Infrastructure

The WordPress security team has released an emergency maintenance and security update, designated as WordPress 7.1.2, addressing a high-severity vulnerability tracked as CVE-2026-87902. The vulnerability allows unauthenticated remote attackers to execute a Path Traversal (CWE-22) that leads to Local File Inclusion (LFI) and, in prevalent hosting environments, full Remote Code Execution (RCE).

Affecting WordPress versions 4.7.0 through 7.1.1, the vulnerability represents one of the most consequential flaws discovered in core CMS logic in recent years. Within hours of the public security bulletin, automated threat scanners and opportunistic adversaries began weaponizing the vulnerability against internet-facing web properties, prompting CISA to add CVE-2026-87902 to its Known Exploited Vulnerabilities catalog.

With WordPress powering over 40% of the world's top ten million websites, the blast radius of this vulnerability extends across corporate intranets, news portals, e-commerce storefronts, and cloud hosting providers. Organizations running self-hosted WordPress installations must verify that automatic updates have executed successfully or perform immediate manual intervention.

Technical Deep-Dive: Template Resolution Breakdown & The pearcmd Exploit Chain

The vulnerability exists within the foundational template hierarchy resolution engine of WordPress, specifically inside the get_page_template() helper function located in wp-includes/template.php and invoked by template-loader.php.

1. The Path Normalization Bypass

When an HTTP request is dispatched to a WordPress page, the CMS evaluates custom page templates designated by the post's metadata (_wp_page_template) or requested via dynamic template query parameters. The template loader constructs candidate file paths to locate corresponding template files within the active theme or child theme directory: 

// Vulnerable logic pattern in get_page_template() (WordPress <= 7.1.1)
function get_page_template() {
    $id = get_queried_object_id();
    $template = get_post_meta( $id, '_wp_page_template', true );
    
    // Insecure: Fails to enforce realpath() validation or sanitize relative traversal tokens
    if ( $template && 'default' !== $template ) {
        $templates = apply_filters( 'page_template', array( $template ) );
        $file = locate_template( $templates );
        if ( ! empty( $file ) ) {
            return $file;
        }
    }
    return get_query_template( 'page' );
}

Under specific conditions—such as when the active theme incorporates a custom directory hierarchy beginning with page-* or when query parameters manipulate the requested template slug—an attacker can inject directory traversal sequences (../) into the template resolution query. Because the code failed to validate whether the resolved file resided within the designated wp-content/themes/ boundary, the template loader treated external readable .php files on the underlying filesystem as legitimate page templates and passed them directly to PHP's include construct.

2. Escalation from LFI to RCE via pearcmd.php

Local File Inclusion bugs typically require existing server files to execute arbitrary attacker code. In standard PHP environments (such as Docker containers or Linux distributions with PHP-CLI installed), the PHP Extension and Application Repository (PEAR) management script pearcmd.php is commonly installed in standard system paths like /usr/local/lib/php/pearcmd.php or /usr/share/pear/pearcmd.php.

When pearcmd.php is included within a web request context, it parses incoming query string arguments from $_SERVER['argv'] as if they were command-line flags. Attackers exploit this behavior by sending an HTTP GET request that combines the template traversal LFI with PEAR's config-create command: 

# Threat actor HTTP request chaining CVE-2026-87902 with pearcmd.php
GET /?+config-create+/&template=../../../../../../usr/local/lib/php/pearcmd.php&/+/var/www/html/wp-content/uploads/shell.php HTTP/1.1
Host: target-wordpress-site.com
User-Agent: Mozilla/5.0 (Security-Audit-Tool)

When WordPress executes include('/usr/local/lib/php/pearcmd.php'), the PEAR command runner interprets the query parameters, creates a new configuration file containing the embedded PHP payload (), and writes it directly to the writable wp-content/uploads/ directory. The attacker then requests the newly created shell.php, achieving unrestricted, unauthenticated remote code execution. 

# Architectural Flow of CVE-2026-87902 Weaponization:
[ Unauthenticated Adversary ]
        │
        ▼ (Submits crafted GET request with ../ traversal & pearcmd arguments)
[ Web Server Front-End : Nginx / Apache ]
        │
        ├─► [ WordPress Core Engine: template-loader.php ]
        │         ├─ get_page_template() processes malformed template parameter
        │         └─ Sanitization failure: Locates /usr/local/lib/php/pearcmd.php
        │
        ├─► [ PHP Runtime: include() Execution ]
        │         ├─ pearcmd.php parses query string from $_SERVER['argv']
        │         └─ Writes configuration artifact with web shell payload to /uploads/
        │
        ▼
[ Remote Code Execution ]
        ├─ Attacker queries /wp-content/uploads/shell.php
        ├─ Executes arbitrary system commands under www-data / nobody
        └─ Extracts wp-config.php database credentials (DB_NAME, DB_PASSWORD)

Observed Exploitation Telemetry & Incident Response

Telemetry collected across global honeypots and enterprise perimeter sensors indicates heavy scanning activity originating from bulletproof hosting infrastructure. Automated botnets are issuing high-volume HTTP requests testing for the presence of pearcmd.php and evaluating whether the target server's PHP configuration has register_argc_argv enabled.

Observed indicators of compromise (IOCs) include:

  • Access Log Query Strings: Requests containing config-create, pearcmd, or URL-encoded traversal patterns like %2e%2e%2f targeting index or page query endpoints.
  • Suspicious Upload Artifacts: Newly created .php files inside wp-content/uploads/ or /tmp/ with non-standard ownership or containing base64-encoded payload strings.
  • Process Anomalies: Web server worker processes (php-fpm, httpd, apache2) spawning interactive shells such as /bin/sh, /bin/bash, or curl/wget download utilities fetching second-stage cryptominers and botnet payloads.

Defensive Playbook: Verification, Mitigation & Remediation

Securing WordPress environments against CVE-2026-87902 requires patching the core CMS and implementing perimeter web application firewall (WAF) filtering.

1. Upgrade WordPress Core via WP-CLI

Execute the following commands on all hosting servers to upgrade WordPress installations to version 7.1.2: 

# Verify current WordPress core version and upgrade to latest release
wp core check-update --path=/var/www/html

# Perform automated core upgrade
wp core update --path=/var/www/html

# Verify successful patch installation
wp core version --path=/var/www/html

2. Implement Nginx / Apache Perimeter Rules

To protect legacy or pending WordPress installations before core patching can take place, deploy immediate web server filtering rules blocking path traversal in query strings: 

# Nginx configuration snippet to block CVE-2026-87902 exploitation
location / {
    # Block requests attempting directory traversal in query strings
    if ($args ~* "(pearcmd|config-create|../|..\\)") {
        return 403;
    }
    try_files $uri $uri/ /index.php?$args;
}

3. Technical Vulnerability Specification

Attribute Vulnerability Specification Operational Risk Implication
CVE Identifier CVE-2026-87902 Active exploitation cataloged in CISA KEV
Vulnerability Class CWE-22 (Path Traversal) / CWE-98 (PHP Remote File Inclusion) Unrestricted template loader traversal to local PHP files
CVSS v3.1 Score 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Unauthenticated remote code execution via pearcmd chain
Affected Versions WordPress 4.7.0 through 7.1.1 Global footprint across enterprise and public websites
Fixed In WordPress 7.1.2 and backported releases Official security update available via WordPress.org

Actionable Checklist for Web Security Teams

  • Audit Hosting Containers: Remove unnecessary CLI tools (e.g., pearcmd.php) from production PHP web containers if PEAR is not actively required.
  • Disable register_argc_argv: Ensure register_argc_argv = Off is configured in php.ini to neutralize command-line parameter parsing from web query strings.
  • Lock Down Upload Permissions: Configure the web server to disallow script execution inside wp-content/uploads/ (e.g., disallow execution of .php files).
  • Review File Integrity: Run wp core verify-checksums to detect modified or backdoored WordPress core files.