Affected Systems
WordPress versions 4.7 through 7.1.1. Exploitation requires a theme with a top-level directory starting with 'page-' and a readable local .php file (e.g., pearcmd.php). Official PHP Docker images and cPanel with PHP <8.5 are vulnerable by default. Versions before 4.6 remain unpatched.
Exploitation Status
Active exploitation confirmed. Attackers progressed from reconnaissance (within 5 hours of patch release on Sept 22, 2026) to writing malicious PHP files to disk for remote code execution. Attack volume increased tenfold as of Sept 23. Payloads observed writing shell command execution backdoors to /tmp and /var/tmp.
Business Impact
Unauthenticated attackers can achieve remote code execution on vulnerable WordPress sites, leading to full site compromise. Threat actors are actively writing backdoors (e.g., wp-pear-rce-flag.php, luci_*.php, zeta_*.php) to disk for persistent access. Organizations running WordPress on Docker or cPanel with older PHP versions face elevated risk. Sites using themes with 'page-*' directories are exploitable. Immediate patching required to prevent compromise.
Urgency
🔴 Immediate
Recommended Actions
- Update all WordPress installations to version 7.1.2 immediately; patches backported to 4.7+ are available
- Block source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b at perimeter firewalls and WAF
- Search web server logs for double-encoded traversal sequences in 'pagename' parameter and requests targeting pearcmd.php
- Scan /tmp and /var/tmp directories for suspicious PHP files matching patterns: wp-pear-rce-flag.php, poc87902.php, luci_*.php, zeta_*.php
- Review themes for top-level directories starting with 'page-' and assess exposure; consider disabling PHP register_argc_argv if not required