Read-only PHP diagnostic script that checks WordPress version, core checksums, extra PHP files, and known plugin paths for CVE-2026-87902 exposure and compromise indicators.
A single-file, read-only diagnostic checker for WordPress CVE-2026-87902 and several useful compromise indicators.
The script does not modify or delete anything. It checks:
page-* directories;register_argc_argv, PHP include_path, and whether pearcmd.php is resolvable;wp-admin, wp-includes, and the WordPress root;Put wp-cve-2026-87902-check.php in the WordPress root next to wp-load.php.
Replace:
$ACCESS_KEY = 'CHANGE-ME-TO-A-LONG-RANDOM-STRING';
with a long random string.
Open:
https://example.com/wp-cve-2026-87902-check.php?key=YOUR_KEY
Save the output and delete the checker from the server.
CLI execution is also supported:
php wp-cve-2026-87902-check.php
The checker itself targets PHP 5.6+ and WordPress 4.7+. It can therefore be used on older WordPress 5.x installations as well.
For multilingual sites, it does not assume that the current site locale is the locale of the installed WordPress Core package. Core checksum verification tries relevant package/site locales and en_US.
This is not a full malware scanner and cannot prove that historical compromise never happened. An INFO label for a known cache/security path only means that the path is normally used by the corresponding plugin; inspect file contents if anything else looks suspicious.
The report contains absolute filesystem paths and administrator usernames/emails. Do not publish raw reports without redacting them.
Official WordPress advisory:
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp