461.25.09.26- Critical WordPress Vulnerability CVE

461.25.09.26- Critical WordPress Vulnerability CVE-2026-87902 Severity: Critical CVSS Score: 9.2 Affected Product: WordPress Core Affected Versions: WordPress 4.7.0 through 7.1.1 Overview TT-CSIRT is advising organizations using WordPress to urgently apply security updates for CVE-2026-87902, a critical WordPress Core vulnerability that allows attackers to access unintended PHP files and achieve remote code execution. Exploitation has also been observed using public scanning and proof-of-concept tools increasing the risk of automated attacks against vulnerable internet-facing WordPress sites. Impact - access files outside of the intended WordPress theme directory - execute malicious PHP code - modify or compromise website content - access sensitive information or credentials - establish persistence on the affected server - use the compromised system to support further malicious activity. Indicators of Potential Exploitation - Suspicious directory traversal patterns in pagename parameters, including encoded values such as %2e%2e or %252e%252e. - References to pearcmd.php, config-show, or config-create. - Unusual requests targeting /index.php or the website root. - Unexpected PHP files in writable directories such as /tmp or /var/tmp. - Monitor for variations in request methods, encoding, and user-agent strings, rather than relying only on IP addresses or a single exploit pattern. Recommended Actions - Update WordPress immediately to version 7.1.2 or the applicable patched release. - Confirm automatic security updates were successfully applied. - Review web server, WAF, and application logs for suspicious activity. - Inspect WordPress and writable directories for unexpected PHP files or artefacts. - Apply temporary WAF/web server rules to block directory traversal attempts. - Enforce least privilege for web server and PHP service accounts. - Maintain secure backups and verify restoration procedures. - If compromise is suspected, isolate the system, preserve logs, investigate, and remediate before restoring service. TT-CSIRT strongly recommends that organizations prioritize patching and immediately review affected systems for signs of compromise. References - WordPress 7.1.2 Security Release - Patchstack – CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch - Tech Insider – WordPress CVE-2026-87902 Exploited Hours After Disclosure - Help Net Security – WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)