CVE-2026-87902

WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)

WordPress 7.1.2 with the identical setup blocks the oracle entirely (negative control). This demonstrates code execution as the WordPress web-server user inside the container. It does not demonstrate root access, container escape, lateral movement, or host compromise.

Quick start

Requirements: Docker with Compose v2, Python 3.10+, network access to Docker Hub and wordpress.org (theme install).

This builds the vulnerable lab, requires the LFI oracle and the RCE marker to fire, then builds the patched lab and requires the oracle to stay silent.

To use another loopback port: LAB_PORT=9499 ./lab verify.

Remove everything afterwards with ./lab reset.

Expected evidence

Vulnerable control:

Patched control:

An HTTP 200, a WAF block, or a partial traversal without the oracle marker is not accepted as proof.

Manual lab lifecycle

Run the tooling by hand against the running lab:

For systems you own or are explicitly authorized to test (bug-bounty scope, written engagement), the drivers require the explicit override:

Root cause

get_page_template() in wp-includes/template.php builds a candidate template filename from the pagename query variable. The sibling branch three lines above passes the page-template slug through validate_file(); the pagename branch never did, and additionally pushes an extra urldecode()-decoded candidate:

7.1.2 applies validate_file() to the decoded candidate and adds a containment gate (_wp_is_template_path_allowed()) that every resolved template path must pass.

Preconditions

1. The active theme (child or parent - locate_template() checks both) ships a top-level directory starting with page-. Legacy default themes (Twenty Twelve, Twenty Fourteen) and several wp.org themes (Neve, Hestia, Sydney) qualify. Researched commercial themes (Divi, Avada, Flatsome, Woodmart, Betheme, The7, Enfold, Salient, Jupiter/X, Porto, Houzez, XStore, Kalium, Uncode) ship none - the traversal cannot resolve; see PRO_THEME_PAGE_DIRS in the PoC for the mirror-sourced list.
2. The included file must end in .php (appended by the code).
3. RCE additionally needs register_argc_argv = On and PEAR's pearcmd.php.

Lab-verified operational notes (beyond the public advisories)

The advisory and the Patchstack writeup decline to publish a working request. These details were established empirically in this lab:

1. A page_id anchor is mandatory. An unresolved pagename flips is_404, whose template shadows get_page_template() entirely. Anchor the query with any resolvable published page_id.
2. Full double-encoding is required. get_posts() rewrites pagename through sanitize_title_for_query( wp_basename( … ) ): raw .. becomes -, but %hex sequences survive; the extra urldecode() in get_page_template() reveals the traversal. Only %252e/%252f works.
3. Pretty permalinks force POST (redirect_canonical 301s GET and drops the payload; it returns immediately for non-GET/HEAD).
4. Exact depth: four ../ from page-templates/ on a standard docroot.
5. The payload fires from the POST body too (WP merges $_POST into query vars) - the basis of the WAF-evasion tiers.
6. pearcmd transport quirks: PHP does not urldecode $argv tokens, and PEAR's config serializer escapes both quote styles - hence the raw, quoteless, +-separated probe.

Toolkit

WAF fingerprinting covers Imperva/Incapsula, Cloudflare, Akamai, AWS CloudFront/WAF, Sucuri, F5. Eight oracle variants: double-encoded, alternate %25%32%65 spelling, parameter pollution, triple-encoded - each in query string and POST body. Multipart bodies and raw-slash payloads were tested and rejected (WP does not process them for this sink).

Affected and tested versions

Repository layout

Not committed: .lab-state, __pycache__/, screener output files.

Validation boundaries

References

• GHSA-7hp8-65ch-5whp
• Patchstack: WordPress 7.1.2 security release - unauthenticated LFI to RCE
• Hadrian: CVE-2026-87902 working PoC - independent reconstruction (confirms the page_id anchor and double-encoding requirements; source of the comparative wp-content/index.php empty-body oracle, included here as a fallback for hardened sites)
• dinosn: cve-2026-87902-wordpress-lfi-lab (independent lab arriving at the same request shapes; source of the nonexistent-target causation control now applied to every oracle hit)
• WordPress 7.1.2 release announcement
• NVD entry

Vulnerability reported by Robert Ressl. This repository is independent third-party analysis and tooling.

License

MIT - see LICENSE.

Safety boundary

Run this repository only on systems you own or are explicitly authorized to test. The lab driver refuses variants other than vulnerable/patched, the Python drivers refuse non-loopback targets unless --allow-authorized-non-loopback is supplied, and the Compose port is bound to 127.0.0.1.

See SECURITY.md for disclosure handling. This repository does not include production targets, customer data, access tokens, or evidence from real systems.

Concretely:

• Docker publishes WordPress on 127.0.0.1 only.
• The default PoC mode is a harmless LFI oracle: it includes wp-links-opml.php, a stock core file that prints an OPML document.
• --rce is opt-in and writes a quoteless, self-deleting marker probe (<?=id,unlink(__FILE__)?>) via the publicly documented pearcmd.php config-create technique; the probe removes itself on its single execution and the PoC verifies deletion. No shells, callbacks, or persistence.
• The lab re-provisions from pristine official images on every start; no target instrumentation.
• Requests are single-host, sequential, and rate-limited. No mass scanning.