WordPress Path Traversal Vulnerability Exploited Immediately

What is CVE 2026 87902?

The security community identified a new flaw in the core of WordPress that received the identifier CVE 2026 87902. The vulnerability is a path traversal issue that permits an unauthenticated attacker to request files outside the intended directory structure. By chaining the traversal with arbitrary file inclusion, the attacker can execute code on the server without needing valid credentials.

Technical mechanics

WordPress processes certain HTTP parameters to locate theme and plugin files. The flaw stems from insufficient validation of the file parameter in a REST endpoint. An attacker can inject sequences such as ../ repeatedly to climb the directory tree, reach the WordPress root, and then load any PHP file that resides there. Once a PHP file is loaded, the attacker can inject malicious payloads that run under the web server user.

Because the request does not require authentication, the attack surface includes any public-facing WordPress installation that has not applied the patch released shortly after disclosure.

Timeline of the exploit

The vulnerability was publicly disclosed on 12 June 2026 via the official WordPress security announcements channel. Within 45 minutes, security researchers observed active exploitation attempts targeting popular plugins that rely on the vulnerable endpoint. By the end of the first day, multiple compromised sites reported defaced pages and cryptomining scripts.

Immediate impact on WordPress sites

Websites that run the default configuration and have not installed the security update experienced the following symptoms:

• Unexpected files appearing in the web root.
• Sudden spikes in CPU usage caused by malicious scripts.
• Outbound connections to known mining pools.
• Loss of administrative access due to credential theft.

Large hosting providers reported that the exploit spread across shared environments, affecting dozens of customers per server.

Mitigation steps for administrators

WordPress released a patch on the same day as the disclosure. Site owners should take the following actions without delay:

1. Update WordPress core to version 6.5.3 or later.
2. Verify that all plugins and themes are updated to their latest versions.
3. Review server logs for requests containing ../ patterns.
4. Implement a Web Application Firewall rule that blocks path traversal payloads.
5. Rotate all administrative passwords and revoke any compromised API keys.

Patch deployment best practices

For organizations that manage multiple WordPress installations, a staged rollout is recommended. Begin with a test environment, confirm that the update does not break custom functionality, then push the patch to production during a low‑traffic window. After deployment, monitor error logs for any residual exploitation attempts.

Broader implications for the WordPress ecosystem

The rapid exploitation of CVE 2026 87902 underscores the importance of a coordinated vulnerability disclosure process. While the WordPress security team acted quickly, the window between disclosure and active attacks was narrow. This incident highlights three key lessons for developers and site owners.

Lessons for developers

• Never trust user‑supplied input when constructing file paths. Use built‑in sanitization functions and enforce a whitelist of allowed directories.
• Adopt a defense‑in‑depth strategy that includes runtime monitoring and intrusion detection.
• Participate in the WordPress security mailing list to receive early warnings about emerging threats.

How to detect exploitation attempts

Early detection can limit damage. Administrators should look for the following indicators in access logs:

• Requests to /wp-json/wp/v2/media that contain multiple ../ sequences.
• Unusual POST requests with large payloads targeting the REST API.
• Sudden creation of files with names that do not match known plugins or themes.

Integrating log analysis tools with threat‑intelligence feeds from sources such as the NIST National Vulnerability Database can automate the detection of known exploit patterns.

Recommended monitoring tools

Open‑source solutions like SANS Institute guidelines suggest configuring ModSecurity with custom rules for path traversal. Commercial Web Application Firewalls often include signatures for this specific CVE.

In addition, the CISA alert provides actionable steps for federal agencies and can be adapted for private sector use.

Looking ahead

WordPress remains the most widely used content management system, and its popularity makes it a prime target for attackers. The swift exploitation of this path traversal flaw serves as a reminder that even well‑maintained platforms can harbor critical bugs.

Stakeholders are encouraged to follow the WordPress security announcements and to subscribe to the MITRE CVE entry for ongoing updates. By staying informed and applying patches promptly, site owners can reduce the risk of future compromises.