WordPress flaw CVE‑2026‑87902 actively exploited as attackers plant malicious PHP files via pearcmd.php
Attackers are already exploiting newly disclosed WordPress vulnerability CVE‑2026‑87902, using pearcmd.php to write attacker‑controlled PHP files to disk when certain themes and server setups are in place. The rapid abuse of the flaw raises the risk for organizations that still delay basic website security updates.
A newly disclosed WordPress vulnerability has moved into active exploitation within hours, turning a routine software flaw into a live threat for a large number of websites.
According to security researchers, attackers are already abusing CVE‑2026‑87902 to gain the ability to write arbitrary PHP files on targeted servers. The exploit chain runs through pearcmd.php, a script tied to the PEAR package management framework. It only succeeds when specific theme and server conditions are met, indicating that the initial wave of attacks is aimed at particular configurations rather than the entire WordPress ecosystem at once.
By manipulating pearcmd.php, remote attackers can bypass normal restrictions and drop their own code into a site’s file system. Once that code is in place, they can use the compromised site to steal data, distribute malware, redirect visitors or attempt to move deeper into the hosting provider’s infrastructure. For sites that handle logins, customer portals or payment forms through WordPress, the impact can extend well beyond cosmetic damage.
Researchers observed scanning campaigns soon after public disclosure of the flaw, with automated tools probing for vulnerable installations and trying to deploy malicious payloads where the right conditions exist. That short lag between disclosure and exploitation reflects a broader shift in how quickly threat actors now move to weaponize fresh Common Vulnerabilities and Exposures (CVEs).
Many of the organizations that rely on WordPress—small businesses, media outlets, NGOs and public agencies—lack dedicated security staff and formal patch schedules. Updates may be applied irregularly, and shared hosting can place many different sites on the same server, magnifying the impact when one is compromised.
Because WordPress runs such a large share of the world’s websites, a single mass‑exploitable flaw like CVE‑2026‑87902 can become an internet‑wide event. Banks’ marketing pages, government information portals, hospital appointment systems and local news sites can all be exposed if they share vulnerable components.
The key questions now are whether major hosting providers roll out emergency fixes or configuration changes to blunt the exploit, whether attackers develop variants that work against a broader range of themes and server setups, and whether any high‑profile breaches traced to this CVE prompt regulators to revisit how critical services are allowed to depend on lightly managed web platforms.
Sources
- OSINT