Critical WordPress Bug Patched September 22 Is Already Under Mass Attack, 350,000 Sites Still Exposed

A patch that turned into a roadmap

WordPress released version 7.1.2 on September 22, 2026, to fix a critical path-traversal flaw in its core code. Attackers didn't wait to see if anyone noticed.

Patchstack says it logged its first malicious request at 17:44 UTC that same day, less than five hours after the patch went live, according to Bleeping Computer. By September 23, Patchstack reported that attack volume had jumped more than tenfold and that requests had moved from harmless reconnaissance to actually writing executable PHP files onto servers.

This is the second WordPress security release in as many days. WordPress shipped version 7.1.1 on September 21 to fix separate vulnerabilities nicknamed Click2Shell and Comment2Shell, according to Field Effect. The very next day it had to ship 7.1.2 for CVE-2026-87902.

What the flaw actually does

The bug lives in `get_page_template()`, a function in WordPress core's `wp-includes/template.php` that decides which theme file loads for a given page, according to the Equixly security blog. WordPress applies a validation check, `validate_file()`, to custom page templates but not to the value pulled from the `pagename` URL parameter after it runs through `urldecode()`.

That gap lets an unauthenticated attacker send a double-encoded traversal sequence in `pagename`, paired with a valid `page_id`, and trick WordPress into loading a PHP file that lives outside the theme folder entirely. WordPress's own advisory, quoted by Bleeping Computer, states plainly: "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories."

WordPress rated the flaw 9.2 out of 10 on the CVSS 4.0 scale, critical severity. It was found and reported by security researcher Robert Ressl; HotHardware reported the discovery involved AI assistance, though other outlets describe it simply as a responsibly disclosed finding.

The vulnerability affects every WordPress release from version 4.7.0 through 7.1.1, according to both Equixly and Field Effect, a span covering roughly a decade of software. WordPress backported fixes to older branches given the severity, though releases before 4.6 won't get a patch, per Bleeping Computer.

Full takeover requires more than the patch gap

Not every WordPress site is equally at risk. Two conditions have to line up for the bug to escalate into full remote code execution.

First, the active theme needs a top-level directory whose name starts with "page-." Field Effect lists WordPress's own examples of affected themes: Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney.

Second, the server needs a reachable PHP utility the attacker can abuse to actually write files. Researchers zeroed in on `pearcmd.php`, a command-line tool bundled with some PHP installations. Patchstack documented the exact attack chain: attackers point the traversal at pearcmd's `config-show` argument first to confirm the utility responds to command-line arguments passed through the query string, then swap in `config-create` to write an attacker-controlled PHP payload straight to disk in `/tmp` or `/var/tmp`.

That trick depends on a PHP setting called `register_argc_argv` being enabled. WordPress's advisory notes the official PHP Docker image and default cPanel setups running PHP versions before 8.5 both meet that condition, according to Bleeping Computer. Field Effect is careful to note that pearcmd.php is one example of a reachable file, not the only path to compromise, a distinction worth keeping in mind before assuming every vulnerable site is one request away from a shell.

The scale, and where the reporting gets fuzzy

Shadowserver's scan puts the number of sites still running vulnerable WordPress code at more than 350,000, a figure cited by Tech Times. That number measures exposure, not confirmed compromise. Tech Times' own headline calling this "webshells hit 350K sites" overstates what its body actually supports: 350,000 sites are vulnerable, not 350,000 confirmed victims.

The exact scope of active exploitation is harder to pin down. Tech Times cites honeypot vendor Previdian logging 68 attempts from a single New Jersey IP address, while Aviatrix separately describes 68 exploitation attempts "originating from multiple countries." Those don't appear to be the same dataset, and neither source resolves the discrepancy.

Bleeping Computer published a blocklist of source IPs tied to the campaign: 169.58.48.193, 169.58.48.195, and the IPv6 address 2001:df1:e8c0::106b. Payload files observed so far carry names like wp-pear-rce-flag.php, poc87902.php, and randomized strings such as luci_ and zeta_ prefixes, dropped into temporary directories.

What site owners should actually do

Every source agrees on the fix: update to WordPress 7.1.2, or the backported patch for your branch, immediately. Patchstack customers received a virtual patch through the company's RapidMitigate rule, but that's a stopgap, not a substitute for updating.

Anyone running an older, unpatched install should assume compromise is possible if their theme has a page-prefixed directory and check server logs for the file names and source IPs already circulating. Shadowserver's exposure count will keep shifting in the coming days as sites patch or get compromised. Whether the 350,000 figure falls because of updates or rises because of successful attacks is the open question nobody in this reporting has answered yet.