Scans WordPress Core 4.7.0–7.1.1 for CVE-2026-87902 unauthenticated LFI via double-encoded pagename traversal, with optional PEAR config-create RCE escalation and mass scanning.
WordPress Core get_page_template() / locate_template() Path Traversal Exploit Tool
For authorized security testing only. Unauthorized access to computer systems is illegal.
| Item | Details |
|---|---|
| CVE ID | CVE-2026-87902 |
| GHSA ID | GHSA-7hp8-65ch-5whp |
| Vulnerability Type | CWE-98 — Improper Control of Filename for Include/Require |
| CVSS v3.1 | 8.1 (High) / CVSS 4.0: 9.2 (Critical) |
| Affected Component | WordPress Core |
| Affected Versions | 4.7.0 through 7.1.1 (all branches) |
| Fixed Versions | 7.1.2 (and backports down to 4.7.37) |
| Authentication Required | None (Unauthenticated) |
| Attack Vector | Single GET request |
| Discovered By | Robert Ressl (via WordPress HackerOne program) |
| Disclosure Date | September 22, 2026 |
| Exploited in the Wild | Yes — listed in CISA KEV catalog |
CVE-2026-87902 is an unauthenticated path traversal and local file inclusion (LFI) vulnerability in WordPress Core that affects every WordPress version released since 2016 (4.7.0 to 7.1.1). An attacker requires no account or authentication. By crafting a malicious pagename query parameter, the attacker can cause WordPress's page template resolution mechanism to include any readable .php file outside the active theme directory. Under specific server conditions (PHP register_argc_argv = On and a readable pearcmd.php), the vulnerability can be escalated to remote code execution (RCE).
| Branch | Fixed Version |
|---|---|
| 4.7.x | 4.7.37 |
| 5.0.x | 5.0.29 |
| 5.3.x | 5.3.25 |
| 5.9.x | 5.9.18 |
| 6.0.x | 6.0.16 |
| 6.6.x | 6.6.9 |
| 6.9.x | 6.9.9 |
| 7.0.x | 7.0.6 |
| 7.1.x | 7.1.2 |
The vulnerability resides in get_page_template() in wp-includes/template.php. When the pagename query variable is present, the function constructs page-{$pagename}.php but fails to call validate_file() on that value to check for directory traversal. The candidate filename is then passed to locate_template(), which concatenates it with the theme directory path and only checks file_exists() — it does not verify the resolved path stays inside the theme directory. A template name containing ../ can therefore resolve to a readable PHP file outside the active theme and be included and executed.
GET /?page_id=&pagename= → WP_Query resolves page_id, matches a published page (avoids 404) → get_page_template() urldecode()s pagename, builds page-{$pagename}.php → locate_template() concatenates candidate to theme directory, resolves via file_exists() → template-loader executes realpath() + include
WordPress applies sanitize_title_for_query() to pagename, which replaces literal dots (.) with hyphens (-) to block traversal. It operates on already once-decoded input and does not recursively decode. The attacker sends %252e%252e%252f (double-encoded ../):
%252e → %2e, %252f → %2fsanitize_title_for_query() sees %2e%2e%2f (no literal dots) and passes it throughget_page_template() internally calls urldecode() again: %2e%2e%2f → ../page- (e.g., page-templates/).page_id..php (WordPress appends the extension).Windows Host Note: Win32 normalizes .. lexically, so traversal may work even if the page- directory does not exist. On Linux, that directory must actually exist.
Conditions:
register_argc_argv is set to Onpearcmd.php exists on the serverThe attacker includes pearcmd.php via LFI and abuses its config-create command to write a PHP file to the server, then includes that file again via LFI to execute arbitrary commands.
CVE-2026-87902 was discovered and reported by Robert Ressl, a Switzerland-based security researcher.
Reported through the WordPress HackerOne program in July 2026. WordPress Security Team coordinated the fix and released it alongside WordPress 7.1.2 on September 22, 2026.
| Date | Event |
|---|---|
| July 2026 | Robert Ressl reports the vulnerability via WordPress HackerOne program |
| September 22, 2026 | WordPress 7.1.2 released with the fix; advisory published |
| September 22, 2026 | Security backports released for branches 7.0 through 4.7 |
| September 23, 2026 | Attackers begin probing vulnerable sites |
| September 25, 2026 | CISA adds CVE-2026-87902 to the KEV catalog |
| Feature | Description |
|---|---|
| Version Fingerprinting | Identifies WordPress version via meta generator, RSS feed, OPML, readme.html, asset ?ver= |
| Smart Version Verdict | Uses fixed-version mapping to determine whether the target is in the affected range |
| Theme Discovery | Extracts active theme slug, detects parent theme, discovers page-* directories |
| Page ID Discovery | Finds valid page IDs via REST API, page-id- body class, shortlinks |
| LFI Oracle Validation | Uses safe files like wp-links-opml.php and wp-trackback.php as oracles with negative controls |
| Double-Encoded Traversal | Automatically double percent-encodes / and . to bypass sanitize_title_for_query() |
| PEAR RCE Exploitation | Tries common PEAR paths, writes and executes marker files via config-create |
| Mass Scanning | Multi-threaded concurrent scanning of target lists |
| Result Output | Persists results to vuln_lfi.txt and vuln_lfitorce.txt |
pip install requests
python3 CVE-2026-87902.py
Interactive menu:
[1] Single Scan LFI [2] Single Scan LFI + RCE [3] Mass Scan LFI [4] Mass Scan LFI + RCE [5] Exit
Choose [1], enter the target URL:
url > https://target.example.com
Choose [2], enter URL and command (default id):
url > https://target.example.com cmd > id
Choose [3] or [4], enter the file containing target URLs (one per line, # for comments):
file > targets.txt
| File | Content |
|---|---|
| vuln_lfi.txt | Confirmed LFI targets |
| vuln_lfitorce.txt | Successful RCE targets |
TIMEOUT = 8 # Request timeout (seconds) THREADS = 200 # Concurrent threads for mass scanning USE_ALL_ORACLES = False # Use all oracles (more accurate but slower)
.., %2e, %252e in the pagename parameter at the WAF or reverse proxy layerpage-* directoryregister_argc_argv settingThis tool is intended for authorized security testing and educational purposes only. Users must ensure they have explicit written authorization for the target system. Unauthorized use may violate the CFAA, the UK Computer Misuse Act, and similar laws in other countries. The author assumes no liability for any misuse.