New WordPress Zero‑Day Under Active Attack Puts Millions of Sites at Risk
Attackers began exploiting a newly disclosed WordPress vulnerability, tracked as CVE‑2026‑87902, within hours of it becoming public. By abusing pearcmd.php under certain theme and server conditions, they can plant their own PHP files on websites—turning everyday blogs, shops and news outlets into potential malware hosts or disinformation platforms.
A newly disclosed hole in WordPress is already being used to break into sites, a reminder of how quickly digital weaknesses turn into live operations once they’re exposed.
The vulnerability, cataloged as CVE‑2026‑87902, was made public only hours before security researchers began seeing real‑world exploitation attempts. The flaw lets attackers abuse a script called pearcmd.php to write their own PHP files to disk on vulnerable servers, effectively giving them a foothold to run arbitrary code.
The exploit isn’t universal. It depends on specific combinations of themes and server configurations being present. But given WordPress’s sheer scale—it powers a large share of the world’s public websites—even a subset of vulnerable installations represents millions of potential targets for criminals, hacktivists, or state‑linked operators.
For site owners, the risk is straightforward. An attacker who can drop PHP files onto a server can deface pages, steal user data, add hidden backdoors, or quietly inject malware into downloads. An online store could be turned into a credit card skimmer. A small media outlet’s site could be hijacked to push disinformation or phishing lures that appear to come from a trusted source. Because the attack leverages a core script and not an obscure plugin, it may be harder for non‑specialists to spot.
Visitors may never know something is wrong until their browser flags a problem or their credentials show up for sale. A compromised WordPress site can become a silent relay, feeding malicious content through normal channels like newsletters, embedded widgets, and social media previews. For organizations that rely on their websites as their public face, the reputational damage from such an incident can be as costly as the technical cleanup.
Operationally, the speed of exploitation is as concerning as the flaw itself. The path from disclosure to active attack was measured in hours, not days, which means defenders have to assume that automated scanners are already crawling the internet looking for the right mix of theme and server setup. Security teams that aren’t monitoring logs or file changes in real time could miss the brief window between a probing request and a successful file write.
At a strategic level, the incident underlines a broader problem with the modern web: a handful of content management systems and libraries now underpin everything from personal blogs to critical local news sites and small government portals. A zero‑day vulnerability in that common stack doesn’t just endanger isolated servers—it provides a potential mass entry point for campaigns that blend cybercrime, influence operations and espionage.
The shareable lesson is blunt: for attackers, WordPress isn’t a blogging engine, it’s an ecosystem. A single exploit chain that works on even a fraction of that install base is worth rushing to weaponize.
In the coming days, the key things to watch will be whether a reliable patch or mitigation guide is adopted widely, whether major hosting providers move to harden their default configurations, and if any large‑scale compromises—of prominent news outlets, e‑commerce platforms or public‑sector sites—are traced back to CVE‑2026‑87902. How quickly the wider WordPress community responds will determine whether this stays a series of isolated breaches or grows into a broader security event.
Sources
- OSINT