# Critical WordPress flaw under attack within hours, putting millions of sites at hacker risk

*Thursday, September 24, 2026 at 6:13 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-09-24T06:13:13.990Z (3h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/18690.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Hackers began exploiting a newly disclosed WordPress vulnerability, CVE‑2026‑87902, just hours after it was made public, using a PHP tool to plant malicious files on vulnerable servers. The rush to weaponize the bug turns millions of websites — from small businesses to news outlets — into potential launchpads for broader cyberattacks.

Attackers aren’t waiting days or weeks to turn new vulnerabilities into break-in tools. A fresh flaw in WordPress, tracked as CVE‑2026‑87902, is being actively exploited within hours of disclosure, security researchers report, with hackers using it to write their own code directly onto vulnerable servers.

The bug affects certain WordPress setups where a specific combination of themes and server configurations expose pearcmd.php, a PHP-based command-line utility, to the open web. Once an attacker can reach that script and feed it crafted input, they can instruct the server to create attacker-controlled PHP files on disk. Those files in turn can act as backdoors, letting the intruder run arbitrary commands, steal data or pivot deeper into the victim’s network.

Not every WordPress site is exposed. The attack chain depends on particular themes and server conditions, which narrows the immediate blast radius. But WordPress powers a large share of the world’s public-facing websites, including small businesses, NGOs, media outlets and government portals. Even if only a fraction of those installations are vulnerable, that still translates into a broad pool of potential targets.

For site owners, the risk is not just defacement or spam pages. Once an attacker can write PHP files to the server, they can exfiltrate databases full of customer records, plant credential-stealing code on login pages, or quietly enroll the site in a botnet used for distributed denial-of-service (DDoS) attacks and credential stuffing. Visitors to compromised sites may see no sign anything is wrong while their traffic is being abused to power other intrusions.

For hosting providers and managed WordPress services, the exploit’s fast adoption is another stress test. Providers must now scan for exposed pearcmd.php endpoints, detect unfamiliar PHP files dropped in theme or upload directories, and push patches or configuration changes at scale. The gap between public disclosure and live exploitation has been shrinking for years; this case shows how that gap can now be measured in hours rather than days.

Strategically, CVE‑2026‑87902 is a reminder that the security of the internet’s infrastructure depends heavily on the least resourced actors — the small site operators who lack in-house security teams but host code that lives on the same servers and networks as higher-value targets. Compromised WordPress instances can become stepping stones into corporate environments, especially when developers reuse passwords, store API keys in site configs, or tunnel from production servers back into internal systems.

The exploit’s reliance on a generic PHP utility also raises uncomfortable questions about how many similar tools sit exposed on misconfigured servers. Attackers are adept at chaining seemingly minor oversights — a forgotten debug script, a world-readable configuration file, an outdated plugin — into a full compromise. When disclosure instantly cues them where to look, the race begins with defenders already behind.

A useful way to see this is that a public vulnerability isn’t just a bug report anymore; it’s a to-do list for both sides. Hackers read it as a how-to manual unless defenders act just as fast.

Signals to watch include how quickly major hosting providers roll out automated checks or mitigations, whether exploit attempts show up in broad internet scan telemetry, and if we start to see this vulnerability cited in ransomware incidents or data-breach reports. Any emergency security updates from popular WordPress theme vendors, or guidance from national cybersecurity agencies, will be further signs that CVE‑2026‑87902 has moved from a technical CVE listing into a mainstream cyber threat.