CVE-2026-87902-PoC-pwnVader

Shell PoC for CVE-2026-87902, an unauthenticated WordPress core LFI via page-template resolution that chains to RCE through pearcmd.php.

Summary

get_page_template() adds page-{urldecode(pagename)}.php to the page template hierarchy when the pagename query variable contains percent-encoded characters, and locate_template() resolves the candidate with file_exists() / require without validating that the path stays inside the active theme. An unauthenticated attacker can therefore include and execute a chosen readable local .php file outside the active theme.

Preconditions:

1. WordPress < 7.1.2.
2. The active theme contains a top-level directory starting with page- (e.g. the official Twenty Fourteen ships page-templates/). The template name is always prefixed with page-, so the first path component must exist.
3. A valid public page ID so the main query is a page (not a 404). The script discovers one from the core sitemap, the homepage body class, or a small ID probe.

The payload is double-encoded so that sanitize_title_for_query() preserves the %2e/%2f octets; urldecode() inside get_page_template() then rebuilds ../ at template-resolution time.

If the server also has a reachable pearcmd.php and register_argc_argv = On (the default in the official PHP image), the chain escalates to remote code execution: the query string becomes CLI argv via + separators, pear config-create writes an attacker-controlled .php file, and the same LFI includes it.

Usage

Options: --page-id N, --ups N, --pearcmd PATH, --timeout N. --authorized (or VDP_AUTHORIZED=1) is required for any mode that may write when the target is not localhost.

Example output (check)

Example output (check-rce / rce)

If the LFI is confirmed but PEAR is absent (or register_argc_argv is Off), the script reports the precondition clearly and exits without writing anything (exit 3).

Detection logic

1. Find a public page ID (sitemap → homepage body class → numeric probe).
2. For each candidate page-* theme directory and traversal depth, request page-<dir>/../../…/wp-includes/version.php through the pagename parameter (POST, empty body — required because WordPress canonical-redirects GET/HEAD first).
3. A 200 response with a 0-byte body (vs the multi-KB page baseline) proves the inclusion.
4. RCE check: attempt pear config-create through the LFI with a self-deleting payload, then include the written file with a command supplied in the request.

Root cause / fix

Vendor fix in 7.1.2 (wp-includes/template.php):

plus a realpath() containment check in locate_template() (_wp_is_template_path_allowed()). wordpress-7.0.6 contains the byte-identical fix.

Remediation

• Update WordPress core to 7.1.2 (or 7.0.6 for the 7.0 branch).
• Interim: reject pagename values containing traversal sequences (.., %2e%2e, %252e%252e) on every HTTP method, or remove the page-* theme directory precondition.

References

• NVD — CVE-2026-87902: https://nvd.nist.gov/vuln/detail/CVE-2026-87902
• Vendor advisory: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
• Fixed releases: https://wordpress.org/wordpress-7.1.2.tar.gz · https://wordpress.org/wordpress-7.0.6.tar.gz

Disclaimer

For authorized security testing only. The RCE modes use a self-deleting payload and never write anything beyond their own temporary marker file, but they still execute commands on the target — run them only where you have explicit permission.