Attackers are attempting to exploit the WordPress core vulnerability CVE-2026-87902 to write PHP files on vulnerable servers, according to a September 23 update from security firm Patchstack. The firm said traffic rose to more than ten times its first-evening level and now includes payloads that can run shell commands when the written files are accessed. WordPress fixed the critical flaw in version 7.1.2 and backported the repair to supported older branches.

WordPress disclosed the issue on September 22 after researcher Robert Ressl reported it. Its security advisory assigns a 9.2 severity score and says an unauthenticated attacker can make page-template resolution load a readable local PHP file outside the active theme directories. Code execution requires specific conditions in both the active theme and server environment; the flaw does not provide that outcome on every WordPress installation.

Patchstack says the first wave of requests tested whether sites would include ordinary WordPress files. In its September 23 update, it reported a second stage testing whether the local PEAR utility pearcmd.php could be reached. The WordPress advisory says this route depends on a theme directory beginning with page-, a readable PHP target, and a PHP setting that exposes query-string arguments to the included script.

Patchstack also observed requests asking pearcmd.php to create PHP files in /tmp or /var/tmp. Some files contained markers used to test exploitability; others contained code designed to execute a shell command on access. The firm identified suspicious requests combining pagename and page_id parameters with encoded traversal sequences. Its observations establish exploitation attempts, but do not establish how many sites, if any, were compromised.

The WordPress security team lists versions from the 4.7 branch through 7.1.1 among those affected and provides patched releases for branches back to 4.7. Site operators can update to 7.1.2 or the fixed release for their branch. WordPress recommends updating immediately, while Patchstack advises reviewing access logs for traversal requests and checking temporary directories for unexpected PHP files.

Patchstack says publicly available scanning tools are now appearing in the traffic, making further attempts possible across exposed sites. Administrators of sites that were online before patching should review historical logs for successful file-inclusion responses, then investigate suspicious files and server activity if those signs are present. The vendor patch remains the stated fix for the vulnerability.