Critical WordPress Core Flaw Under Mass Attack: 30,000+ Attacking IPs Observed

October 11, 2026 Qamar Abbas 8 min read

Critical WordPress Core Flaw Under Mass Attack: 30,000+ Attacking IPs Observed

The critical WordPress core flaw (tracked as CVE-2026-87902, CVSS score 9.2), fixed in WordPress 7.1.2 on September 22, is under aggressive exploitation in the wild. Researchers observed attack probes less than five hours after the patch was released, and CrowdSec has since observed 30,813 unique IP addresses sending matching attack requests. The critical WordPress core flaw is an unauthenticated local file inclusion that can lead to remote code execution on some servers, and every version from 4.7.0 through 7.1.1 was affected. For site owners, the message is stark: a flaw needing no login, exploitable within hours of disclosure, is being probed at scale.

What Happened: the Critical WordPress Core Flaw

Security researcher Robert Ressl responsibly disclosed the critical WordPress core flaw to the WordPress security team, and WordPress shipped the fix in version 7.1.2 on September 22, 2026. The flaw sits in get_page_template(), the core function that resolves which PHP template file renders a requested page. The critical WordPress core flaw lets an unauthenticated attacker influence that template resolution and cause WordPress to include a chosen readable local PHP file from outside the active theme’s directories — a local file inclusion (CWE-98). If the server and theme conditions line up, inclusion becomes remote code execution.

The conditions are specific, and they are worth stating exactly, because they decide who is actually at risk from the critical WordPress core flaw. Successful exploitation hinges on two prerequisites: the active child or parent theme must contain a top-level directory whose name starts with page- (for example, page-templates), and a chosen local PHP target file must exist on the server and be readable by the web server account (for example, pearcmd.php). “If relevant preconditions for both the server environment and the active theme are met, this can lead to RCE,” WordPress’s advisory states. The CVE was published September 22, 2026, and added to CISA’s Known Exploited Vulnerabilities catalog on September 25.

The attack timeline shows how fast disclosure becomes weaponization. Patchstack recorded the first exploitation effort at 11:49 UTC on September 22 — the same day patches shipped — with payloads matching the exact encoding the patch addresses, meaning the attackers were working from the diff, not from independent discovery. By September 23, Patchstack described three attack stages: first, inclusion of a harmless core file to test whether the host is vulnerable; second, a request aimed at pearcmd.php with a benign command to check it is reachable; third, an actual file-write attempt. Some payloads only write a marker string — someone building a list of vulnerable hosts — while others write a short tag that runs a shell command when accessed. The written files landed in /tmp and /var/tmp under names like wp-pear-rce-flag.php, poc87902.php, luci_<random>.php, and zeta_<random>.php. One observed chain included the local PHP file /usr/local/lib/php/pearcmd.php, wrote a file to /tmp/, then pulled a PHP upload script hosted on GitHub. A scanner user-agent named after a Nuclei template showed up in the traffic, confirming commodity tooling was already in play.

Who Is Affected by the Critical WordPress Core Flaw

Every WordPress site running versions 4.7.0 through 7.1.1 was affected by critical WordPress core flaw — a span covering roughly a decade of releases and a huge share of the WordPress population. But “affected” and “exploitable to RCE” are different things, and the distinction matters for triage. The local file inclusion itself is reachable without authentication on unpatched versions; the escalation to remote code execution additionally requires the page--prefixed theme directory and a readable local PHP target like pearcmd.php.

The scale of the probing is what makes the critical WordPress core flaw a mass-attack event rather than a targeted one. CrowdSec counted 322,680 matching signals between September 23 and 27, with daily volume rising from 14,938 to 124,154 and distinct sources climbing from 237 to 23,321 — reaching 30,813 unique IP addresses by September 28. Previdian recorded 68 exploitation attempts against its honeypot network starting September 23, with malicious requests originating from an IP in New Jersey and additional activity from an Indonesia-based address. CrowdSec is careful about what these numbers cannot prove: a matching request is an attempt, not a confirmed compromise (most targets lack the RCE preconditions); unique IP addresses are not unique attackers (one operator can rotate through thousands); and the data comes from machines in the CrowdSec network — a sample, not a census. Still, as Previdian’s founder Ryan Dewhurst put it: “Because WordPress has auto-updates enabled by default, we’re likely to see mass-exploitation attempts, but relatively few actual compromises.” The attempts are the story; the minority of hosts meeting both preconditions are the victims.

Why the Critical WordPress Core Flaw Matters

The critical WordPress core flaw matters because it compresses the entire vulnerability lifecycle into hours. Patches shipped September 22; working exploit payloads derived from the patch diff were in the wild by 11:49 UTC the same day; mass scanning at tens of thousands of source IPs followed within a week. The patch-to-exploitation window is effectively zero. For the large population of WordPress sites without automatic background updates — or with updates disabled by hosts, developers, or neglect — that timeline means exposure begins before most administrators have even read the release notes.

It also matters because core flaws are population flaws. A plugin vulnerability affects that plugin’s install base; a flaw of this class affects every unpatched WordPress on the internet, and the scanning economics follow: attackers can afford to probe millions of hosts because the payload is identical everywhere. The two preconditions act as a filter, but filters cut both ways — the hosts that pass both are disproportionately likely to be long-running servers with older theme structures and PEAR-era PHP files lying around, exactly the sites least likely to be patched promptly. And with the researcher’s proof of concept public and Nuclei-template scanners in circulation, the barrier to participation keeps dropping.

What to Do Now After the Critical WordPress Core Flaw Disclosure

If your site is not on 7.1.2 or your branch’s fixed release, it is a sitting target for critical WordPress core flaw — and compromised sites should be reviewed for post-attack activity.

Update to WordPress 7.1.2 or your branch’s fixed release immediately (7.1.2, 7.0.6, 6.9.9, 6.8.10, and backports such as 4.7.37). This is the single decisive action against the critical WordPress core flaw.
Verify the update actually applied. Check the version in the dashboard and confirm automatic background updates are enabled — Dewhurst’s “relatively few actual compromises” observation depends on auto-updates doing their job.
Audit for the known compromise indicators. Review web-server logs for requests targeting template resolution with unusual file paths, look in /tmp and /var/tmp for the observed filenames (wp-pear-rce-flag.php, poc87902.php, luci_*, zeta_*), and check for unknown administrator accounts or unfamiliar files.
Check your theme for the RCE precondition. If your active theme has a top-level directory starting with page-, your site was in the highest-risk group for critical WordPress core flaw escalation — prioritize the compromise audit accordingly.
Remove or restrict unnecessary local PHP targets. If pearcmd.php or similar PEAR-era files exist on the server and are readable by the web account, determine whether anything needs them; removing dead code shrinks the LFI-to-RCE path for this and future flaws.
Rotate credentials if compromise is possible. A successful exploit of the critical WordPress core flaw means full server-side code execution: rotate salts, database credentials, and admin passwords, and treat stored secrets as exposed.
Stop leaving patching to chance. The critical WordPress core flaw timeline — hours from patch to mass exploitation — is the new normal. Qamar Digital Ventures LLC‘s website care plans include emergency patching, firewall protection, and compromise checks so your business stays safe while you stay focused. Visit https://qamardigitalventuresllc.com/ to get protected.

Critical WordPress Core Flaw: Frequently Asked Questions

What is the critical WordPress core flaw?
An unauthenticated local file inclusion vulnerability in WordPress core’s get_page_template() function, fixed in WordPress 7.1.2 on September 22, 2026. It lets attackers without any account make WordPress include a chosen local PHP file outside the theme directories, and can lead to remote code execution when specific server and theme preconditions are met. CVSS 9.2; listed in CISA’s KEV catalog.

Which versions are affected?
WordPress 4.7.0 through 7.1.1. Fixed releases include 7.1.2, 7.0.6, 6.9.9, 6.8.10, and older-branch backports such as 4.7.37.

How widespread is the exploitation?
CrowdSec observed 30,813 unique attacking IP addresses by September 28, 2026, with 322,680 matching signals over five days. Those are attempts, not confirmed compromises — most targets lack the RCE preconditions — but the scale confirms active mass scanning.

How do I know if my site was compromised?
Look for the attack fingerprints: template-resolution requests with odd file paths in access logs, the known dropped filenames in /tmp and /var/tmp, unknown admin accounts, and unfamiliar files. When in doubt, have a professional run a full compromise assessment.

Critical WordPress Core Flaw: Conclusion

critical WordPress core flaw is the archetype of the modern WordPress emergency: a critical, unauthenticated core flaw, patched on September 22, under active exploitation before the day was out, and mass-scanned by more than 30,000 source IPs within a week. The two preconditions for remote code execution — a page--prefixed theme directory and a readable local PHP file — mean most probed sites will not fall to full RCE, but “most” is cold comfort when the scanning is this broad and the proof of concept is public. The fix is a single update to 7.1.2 or the equivalent backport for your branch, and every hour of delay is an hour of exposure to automated tooling that never sleeps. Sites that were unpatched during the September 22–28 window should not just update — they should audit, because the attacker’s three-stage playbook (recon, pearcmd check, file write) leaves fingerprints worth looking for.

The deeper lesson of critical WordPress core flaw is that the patch-to-exploitation window has collapsed to hours, and manual update habits cannot survive that timeline. Automatic background updates, a web application firewall, and professional monitoring are the difference between a quiet Tuesday and a rebuild-from-backup weekend. Qamar Digital Ventures LLC’s website care plans deliver exactly that: emergency patching, firewall protection, and compromise checks for WordPress sites. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss a care plan for your site.

Sources

Free website & SEO audit

Want results like these?

Get a plain-English teardown of your website and Google visibility — what is broken, what to fix first, and what it would take to outrank your competitors in Albuquerque.

Get My Free Audit

No pressure, no 40-page PDF. Real answers.