CVE-2026-87902 in Brief — What's Happening Right Now
The vulnerability lies in the get_page_template() function, which builds the theme filename from the HTTP pagename parameter without proper validation. An unauthenticated attacker can inject double-encoded directory traversal sequences to force WordPress to include any readable PHP file on the server, outside allowed theme directories.
The flaw is classified as conditional LFI-to-RCE: code execution is not guaranteed on every installation, but the required conditions are widespread. Patchstack observed in the first hours of exploitation payloads using pearcmd.php — present by default in official Docker images and cPanel environments with PHP < 8.5 — to write executable PHP files in /tmp or /var/tmp. The CVSS 4.0 score of 9.2 reflects the complete absence of required authentication and the potential impact on server confidentiality, integrity and availability.
- Include an arbitrary readable PHP file outside the active theme directory via path traversal in the
pagenameparameter - Use
pearcmd.php(present on cPanel/PHP < 8.5 and official Docker images) to write an attacker-controlled PHP file to disk - Drop a webshell in
/tmpor/var/tmpunder a generic name (wp-pear-rce-flag.php,poc87902.php) - Execute shell commands on the server without any WordPress account or user interaction
- Pivot to other sites hosted on the same server if permissions allow
- Exfiltrate database data, API keys or readable
.envfiles
Check Whether Your Sites Are Exposed
The first step is to know the WordPress version of each installation. With WP-CLI, the command is straightforward and runs in seconds, even across a fleet of dozens of sites.
Check the current version and available updates:
wp core version; wp core check-updateList all WordPress installations on a cPanel server (if you manage multiple sites):
find /home -name 'wp-config.php' -not -path '*/wp-content/*' 2>/dev/nullCheck the version of each installation found:
wp --path=/home/user/public_html core versionCheck whether the active theme contains a directory starting with
page-(exploitation condition):ls $(wp --path=/home/user/public_html eval 'echo get_stylesheet_directory();') | grep '^page-'Check if
register_argc_argvis enabled (second exploitation condition):php -r 'echo ini_get("register_argc_argv") ? "EXPOSED" : "OK";'Search for exploitation traces in access logs (characteristic pattern):
grep -E 'pagename=.*\.\..*page_id=' /var/log/nginx/access.log; grep -E 'pagename=.*%2e%2e.*page_id=' /var/log/apache2/access.log
An installation is exposed to RCE if it meets all three conditions: version between 4.7.0 and 7.1.1, active theme containing a page-* directory at root level, and register_argc_argv enabled. LFI alone (without RCE) is possible when the first two conditions are met. Most commonly cited themes include legacy default themes (Twenty Twelve, Twenty Fourteen) and popular third-party themes like Neve, Hestia and Sydney.
Back Up Before Patching
Before any WordPress core update, a backup is essential. On a VPS, the most reliable method is a VM snapshot — it captures the complete disk state in seconds and allows immediate rollback if there's a plugin compatibility issue. In parallel, exporting the database with WP-CLI provides targeted restoration without needing to roll back the full snapshot.
Create a VM snapshot from the VPS control panel (instant operation, rollback in under 2 minutes) — or via API if you automate:
# Example with Proxmox API; pvesh create /nodes/{node}/qemu/{vmid}/snapshot --snapname pre-wp712Export the WordPress database with WP-CLI:
wp db export backup-pre-712.sql --add-drop-tableVerify dump integrity:
wp db checkCopy the dump off the server (remote or local storage):
rsync -avz user@server:/home/user/public_html/backup-pre-712.sql ./
Patching WordPress 7.1.2 — Step by Step
On a VPS with root access, the WordPress update is performed via WP-CLI without any hosting provider involvement. The complete process — backup included — takes less than three minutes. WordPress 7.1.2 was published on September 22, 2026; fixes have also been backported to all maintained branches back to version 4.7.
Put WordPress into maintenance mode to avoid requests during the update:
wp maintenance-mode activateUpdate WordPress core to 7.1.2:
wp core updateVerify the update was applied successfully:
wp core version; # Should return: 7.1.2Update the database if needed:
wp core update-dbFlush object cache and application caches:
wp cache flushDisable maintenance mode:
wp maintenance-mode deactivateCheck for errors in logs and test a key page:
wp eval 'echo get_permalink(get_option("page_on_front"));'; curl -sI https://your-site.com/ | grep HTTPIf multiple sites are hosted, loop over each installation:
for dir in $(find /home -name 'wp-config.php' -not -path '*/wp-content/*' -exec dirname {} \;); do; echo "=== $dir ==="; wp --path="$dir" core update; done
Why Shared Hosting Exposes You Longer
On shared hosting, WordPress core updates are managed by the provider or the control panel (cPanel, Plesk). The window between patch publication and effective application depends on the provider's schedule, server load and their own regression testing. In the case of CVE-2026-87902, active exploitation started less than five hours after the patch was released — well below the update cycle of most shared hosts.
Scroll the table
| Criterion | Shared (cPanel/Plesk) | Root VPS ServOrbit |
|---|---|---|
| Time to patch after publication | Shared hosting: 12 to 72 hours depending on provider | Root VPS: under 3 minutes with WP-CLI |
| Access to access logs | Shared hosting: limited or unavailable depending on plan | Root VPS: full access to /var/log in real time |
| Control over `register_argc_argv` | Shared hosting: set by provider, often enabled | Root VPS: can be disabled via `php.ini` in 30 seconds |
| Site isolation | Shared hosting: same server as other customers | Root VPS: dedicated environment, no neighbors |
| Pre-patch backup | Shared hosting: snapshot unavailable or paid add-on | Root VPS: instant snapshot via API |
The argument "my host updates automatically" no longer holds against exploitation starting at J+0 in under five hours. For CVE-2026-87902, the first malicious requests were recorded on September 22, 2026 at 17:44 UTC — before most shared hosts had time to plan and test their deployment.
Recommended post-patch configuration: (1) Disable XML-RPC if you're not using WordPress mobile apps or Jetpack:
`// In wp-config.php
add_filter('xmlrpc_enabled', '__return_false');`
(2) Force automatic core updates for future security releases:
`// In wp-config.php
define('WP_AUTO_UPDATE_CORE', 'minor');`
(3) Disable register_argc_argv in php.ini to remove the RCE vector via pearcmd.php:register_argc_argv = Off
(4) Add a WAF rule to block traversal patterns in the pagename parameter while the patch propagates to lagging installations.
Troubleshooting — Common Post-Patch Errors
WordPress core updates are usually smooth, but certain environments have predictable issues. Here are the most common cases and their resolution.
- Database connection error after update: run
wp core update-dbif you haven't — some schema migrations don't apply automatically. - White screen or 500 error: check PHP logs (
/var/log/php8.x-fpm.log) and temporarily deactivate all plugins to isolate a compatibility conflict with version 7.1.2:wp plugin deactivate --all. - Permission denied on
wp-content/: WP-CLI must be run as the file owner. On cPanel:su - cpanelusername -c 'wp core update'. - Update impossible, "Filesystem not available" message: configure direct access method in
wp-config.php:define('FS_METHOD', 'direct');— valid only on a VPS where you own the files. - Child theme breaking after patch: if your child theme inherits from a theme with a
page-*directory, check parent theme compatibility with 7.1.2 on the theme's GitHub repository or WordPress.org page. - Stale object cache (Redis/Memcached): after
wp cache flush, restart the cache service if errors persist:systemctl restart redisorsystemctl restart memcached.
From WordPress to a More Robust Architecture
CVE-2026-87902 illustrates a structural reality: WordPress core is a large attack surface, and each critical flaw raises the question of execution environment control. A dedicated VPS doesn't eliminate vulnerabilities, but it reduces the exposure window to minutes, allows auditing the environment (logs, PHP config, process isolation) and precise response to each documented attack vector.
For agencies and developers managing a fleet of WordPress sites, consolidating on a VPS with WP-CLI installed and automated update scripts transforms a security emergency into a routine procedure. The operational cost of a VPS is offset by eliminating the provider delay — which, as this CVE shows, can be decisive.
