Threat actors began exploiting a critical WordPress vulnerability within hours of its public disclosure. Tracked as CVE-2026-87902 (CVSS score: 9.2), the flaw lets an unauthenticated attacker achieve remote code execution (RCE) under specific server and theme conditions. 

The first attempt was logged on September 22, 2026, at 11:49 a.m. UTC, the same day patches were released.

According to the WordPress advisory, an unauthenticated attacker can manipulate page-template resolution in get_page_template() so it includes a chosen, readable local .php file from outside the active theme directories.

Two preconditions apply for this vulnerability:

• The active child or parent theme must contain a top-level directory whose name starts with page- (for example, page-templates). 
• A local .php target file must also exist on the server and be readable by the web server account, such as pearcmd.php.

Previdian reported exploitation attempts against its honeypot network, and its telemetry recorded 68 exploitation attempts from a U.S.- and an Indonesia-based IP. 

Patchstack corroborated the findings and warned that requests had expanded from reconnaissance to active exploitation that writes PHP files to disk.

"We're likely to see mass-exploitation attempts, but relatively few actual compromises," Previdian founder and CEO Ryan Dewhurst has said. While the platform has auto-updates enabled by default, WordPress administrators should:

• Immediately apply version:
  • 7.1.2, 
  • 7.0.6,
  • 6.9.9, 
  • or 6.8.10, 
• Then audit their sites for malicious activity.

A July report warned that an unauthenticated WordPress Exploit, Wp2shell, needed no login or plugins, while an “essential plugin” backdoor that was disseminated to over 20,000 active WordPress installations was flagged in April.