Affected Systems
WordPress versions prior to 7.1.2 (also 7.0.6, 6.9.9, 6.8.10). Exploitation requires active theme with top-level directory starting with "page-" and readable local .php file (e.g., pearcmd.php) on server.
Exploitation Status
Active exploitation confirmed. First attacks recorded September 22, 2026 at 11:49 UTC (same day as patch release). 68+ exploitation attempts observed by September 23 from multiple IP addresses. Attackers using pearcmd.php to write web shells and uploaders to /tmp and /var/tmp directories.
Business Impact
Unauthenticated remote code execution (CVSS 9.2) allows full server compromise. Exploitation requires specific preconditions (theme directory structure and readable PHP files), limiting attack surface. WordPress auto-update feature may reduce widespread impact, but manual patching required for sites with auto-updates disabled. Immediate risk to WordPress installations meeting preconditions.
Urgency
🔴 Immediate
Recommended Actions
- Update WordPress immediately to version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10 for older branches)
- Search web server logs for requests containing 'pearcmd.php', 'page-template', or suspicious .php file paths in GET/POST parameters since September 22, 2026
- Check /tmp and /var/tmp directories for unexpected PHP files matching patterns: wp-pear-rce-flag.php, poc87902.php, luci_*.php, zeta_*.php
- Block known malicious IPs at firewall: 104.194.9.227, 43.250.53.42, 180.251.159.243, 195.178.110.247, 107.189.14.87, 45.61.184.170, 92.246.130.76
- Verify active theme does not contain top-level directories starting with 'page-' or remove pearcmd.php from /usr/local/lib/php/ if present and not required