Five Hours to Weaponization: WordPress Core Flaw Exposes Vulnerabilities in Web Infrastructure

When WordPress core maintainers patched an unauthenticated path traversal flaw on September 22, 2026, the global threat ecosystem responded almost instantly. Within less than five hours of the code release, automated botnets shifted from basic reconnaissance to active exploitation, racing to plant remote code execution (RCE) payloads across vulnerable servers before site owners even opened the advisory.

The rapid weaponization of CVE-2026-87902 highlights a dangerous reality for modern web security: the window between patch publication and automated exploitation has effectively closed. Powering over 40% of the active web, WordPress remains the primary target for opportunistic botnets. In an environment where automated scanners probe millions of domains per hour, a single core vulnerability instantly turns standard hosting setups into high-risk targets.

The Exploitation Chain: From Directory Traversal to Server Breach

The flaw lies in how the core framework processes page templates inside get_page_template(). By sending HTTP requests with double-encoded path sequences in the pagename parameter alongside a valid page_id, an attacker can trick the system into loading local files outside the theme directory.

Turning this path traversal into a full remote code execution breach requires specific, common server conditions: a theme directory starting with page- and exposure to system utilities like PHP’s internal pearcmd.php (default in official PHP Docker builds and pre-8.5 cPanel setups). By manipulating command arguments from config-show to config-create, the exploit forces the server to write malicious PHP webshells directly to /tmp and /var/tmp directories under names like wp-pear-rce-flag.php or luci_<random>.php. When accessed via HTTP, these files execute arbitrary shell commands, granting attackers complete server control.

Backporting to 2016 Code: The Heavy Cost of Outdated Systems

The severity forced the WordPress security team to backport fixes down to version 4.7—a rare intervention for a codebase released in 2016. Versions older than 4.6 will receive no patch, leaving millions of legacy installations permanently exposed.

This extraordinary backport effort underscores a massive gap in web maintenance. While enterprise platforms rely on automated deployment pipelines, vast portions of the web run on unmanaged instances where automatic updates are disabled. Automated botnets exploit this delay, compromising unpatched hosts en masse while site administrators lag behind on manual updates.

Immediate Defensive Audit Guidelines

Relying solely on delayed update schedules is no longer enough. Web administrators and security teams must execute immediate mitigation and verification steps:

• Apply Emergency Upgrades: Confirm that production environments have upgraded to WordPress version 7.1.2 or their respective patched legacy branch (down to 4.7).

• Audit Server Temporary Directories: Inspect server-level /tmp and /var/tmp directories for newly created .php files matching known payload patterns (poc87902.php, zeta_*.php, wp-pear-rce-flag.php).

• Analyze Access Logs: Query web server logs for URI strings containing double-encoded traversal sequences (%252e%252e%252f) in connection with pagename arguments.

• Block Malicious Infrastructure: Implement edge firewall rules blocking inbound traffic from primary scanning ranges identified by security researchers.