rabakuku/cve-2026-87902-a-working-poc-for-wordpress-s-critical-path-traversalReference notes and mitigation configs for CVE-2026-87902, a WordPress Core unauthenticated path traversal and LFI flaw chainable to RCE, with Nginx, Apache, and PHP hardening rules.
🔴 Watch the Full Breakdown & Mitigation Tutorial:
👉 Click Here to Watch on YouTube
This repository provides emergency reference notes, web server mitigation rules, and hardening configs covered in our technical analysis of CVE-2026-87902 (CVSS 9.2 Critical).
CVE-2026-87902 affects WordPress Core versions from 4.7.0 through 7.1.1. It allows an unauthenticated remote attacker to perform path traversal and Local File Inclusion (LFI) via theme template resolution functions (locate_template / get_page_template), which can be chained with environments like pearcmd.php to achieve full Remote Code Execution (RCE).
register_argc_argv in php.iniDisabling this setting neutralizes command-line argument injection through web requests (such as the pearcmd.php RCE vector):
register_argc_argv = Off
Block unauthenticated traversal sequences passed via the pagename query parameter:
# Block path traversal attempts in query parameters
if ($query_string ~* "pagename=.*(\.\.|%2e%2e)") {
return 403;
}
.htaccess / VirtualHost)RewriteEngine On
RewriteCond %{QUERY_STRING} pagename=.*(\.\.|%2e%2e) [NC]
RewriteRule .* - [F,L]
Update your WordPress instance immediately to the patched 7.1.2 release or your branch's specific backported security release:
wp core update --version=7.1.2
Disclaimer: This repository and video tutorial are provided strictly for educational and defense-in-depth security hardening purposes.
http://googleusercontent.com/youtube_content/1