WordPress core flaw exploited the same day it was patched

What happened

This one isn't a plugin. It's WordPress itself.

WordPress core's page-template lookup (get_page_template()) could be tricked into loading a readable .php file from outside the active theme. If the right file already sits on the server, that lets an attacker run code without logging in. The flaw is rated 9.2.

WordPress shipped fixes on September 22, 2026. Patchstack recorded the first exploitation the same day, at 11:49 UTC. Three days later, CISA added the flaw to its Known Exploited Vulnerabilities catalog.

Who is affected

Not every site can be hit. Attacks need two things:

• The active theme (child or parent) has a top-level folder whose name starts with page-.
• A suitable PHP file, such as pearcmd.php, exists on the server and the web server can read it.

Many shared hosts have that second piece by default, so don't assume you're safe. Patch either way.

What to do

1. Update WordPress to the fixed release for your branch: 7.1.2, 7.0.6, 6.9.9 or 6.8.10.
2. Check /tmp and /var/tmp for unexpected PHP files. Names seen in attacks include wp-pear-rce-flag.php, poc87902.php, luci_<random>.php and zeta_<random>.php.
3. If you find any, treat the site as compromised: restore from a clean backup and rotate credentials.

Timeline

• Sept 22, 2026: WordPress ships security releases. First exploitation recorded at 11:49 UTC.
• Sept 23, 2026: Further attack attempts show up in telemetry.
• Sept 25, 2026: CISA adds CVE-2026-87902 to its Known Exploited Vulnerabilities catalog.

Sources

• The Hacker News
• TechRepublic