Hackers rush to exploit new WordPress flaw CVE‑2026‑87902 to plant rogue PHP files on vulnerable sites
Within hours of disclosure, attackers began abusing WordPress vulnerability CVE‑2026‑87902 to write their own PHP files to disk via pearcmd.php, security researchers say. Only sites with specific themes and server setups are exposed, but compromised servers can be turned into silent launchpads for malware and phishing.
Attackers have begun exploiting a newly disclosed WordPress vulnerability almost as soon as details became public, highlighting how little time website owners now have to react.
The flaw, tracked as CVE‑2026‑87902, is already under active attack, according to security researchers. It targets pearcmd.php, a component associated with the PEAR package management system, and uses it to write attacker‑controlled PHP files to a site’s disk.
Once those files are in place, intruders can run their own code on the server. That opens the door to installing web shells, creating hidden administrator accounts, injecting malicious content or using the compromised site as infrastructure for wider intrusion campaigns.
Not every WordPress installation is exposed. The exploit relies on specific theme and server conditions, which narrows the pool of immediately vulnerable sites. But because WordPress is so widely used, even a fraction of installations meeting those conditions gives attackers a large target set.
The risk extends beyond defaced pages. Compromised servers can be used to skim payment information, send convincing phishing emails or host malware for so‑called drive‑by downloads, often without the site owner noticing obvious changes to how the site looks or behaves.
The attacks illustrate how the modern web stack multiplies potential entry points. Even when WordPress core is patched, weaknesses in associated scripts like pearcmd.php can provide a path in.
Key issues to watch now are whether major hosting and theme providers push configuration changes or patches to block the exploit, whether CVE‑2026‑87902 becomes a standard feature in mass‑scanning toolkits, and how often incident responders start seeing it linked with other vulnerabilities to gain deeper access inside organizations.
Sources
- OSINT