If your business site runs on WordPress, check its version today. A flaw in WordPress, CVE-2026-87902, lets an attacker who is not logged in run code on your server, and real attacks started the same day the fix shipped, September 22, 2026. The fix is an update to 7.1.2, 7.0.6, 6.9.9, or 6.8.10, depending on which version line your site is on.
What the attackers are doing is not subtle. They get the server to load a PHP file it should never load, write their own PHP file into a temporary folder, and then pull in an upload script hosted on GitHub. That gives them a web shell, a small file that works as a remote control panel on your site. At that point the site your customers visit, and whatever it stores, is under someone else’s hands. The flaw scores 9.2 out of 10 on the standard severity scale, and the US cyber agency put it on its must-patch list for federal agencies with a September 28, 2026 deadline.
Three things to do now
- Check the WordPress version your site runs. If it is below 7.1.2, 7.0.6, 6.9.9, or 6.8.10 on your line, update it now.
- Ask whoever maintains the site to look for PHP files recently written into /tmp and /var/tmp, and for requests mentioning pearcmd.php in the server logs.
- If either shows up, treat it as a break-in and not a glitch. Rotate passwords and keys, and restore from a backup taken before September 22.
One caveat worth knowing: exploitation needs specific conditions on both the server and the active theme, so many of the attempts being thrown at sites will fail, and WordPress has auto-updates on by default, so your site may already be patched. That is a reason to check the version number, not a reason to assume you are fine.
