CVE-2026-87902-Toolkit

WordPress CVE-2026-87902 LFI-to-RCE toolkit with a weaponized exploit chain (PEAR RCE, webshell, admin creation, loot) and a non-intrusive SafeChecker version and risk auditor.

The flaw affects every WordPress release since 2016 — a decade of versions that passed code review without detection. The root cause is a single missing validation call in one of the most heavily-traversed code paths in the CMS .

How it works

1. Unsanitized template resolution – get_page_template() in wp-includes/template.php builds template candidates from the pagename query variable. A neighboring code path in the same function applies validate_file() to block ../ sequences, but the $pagename branch does not call it. Any traversal in pagename passes unchecked .

2. Double-encoded traversal bypass – WordPress applies sanitize_title_for_query() to pagename, which replaces literal dots (.) with hyphens to prevent traversal. But the function operates on already-decoded input and does not recursively decode. An attacker sends %252e%252e%252f; the web server decodes it once to %2e%2e%2f; the sanitizer sees no literal dots and passes it through; then get_page_template() calls urldecode() again inside the function, producing ../ .

3. Theme directory precondition – The active theme must contain a top-level directory whose name starts with page- (e.g. page-templates/). The constructed filename page-{pagename}.php then escapes the theme root via the traversal. Older default themes (Twenty Twelve, Twenty Fourteen) and popular third-party themes (Neve, Hestia, Sydney) ship this directory. Child themes inheriting from such parents also satisfy the precondition .

4. LFI sink in locate_template() – The candidate path is passed to locate_template(), which searches the theme directories. Because the traversal resolves to a file outside those directories, and the function checks only file_exists(), any readable .php file is included with full web server privileges. This makes the LFI unconditional on any unpatched site meeting the theme precondition — including wp-config.php with its database credentials and authentication salts .

5. PEAR pearcmd.php RCE escalation – PEAR ships with many PHP installations. Its pearcmd.php is normally CLI-only, but when register_argc_argv=On, PHP populates $_SERVER['argv'] from the URL query string. The attacker includes pearcmd.php via the LFI, passes config-create as an argument, and supplies PHP code plus an output path (/tmp/shell.php). PEAR writes the attacker's code to disk; a second include executes it .

6. Second exploitation route – A request combining name (front-page slug), page_id (posts-page ID), preview=true, and a pagename payload diverts WP_Query into its post_name branch, which never rewrites pagename through sanitize_title_for_query(). This allows literal dots in the traversal. Requires a theme without single.php .

7. Server configuration requirements – RCE depends on two conditions common in real deployments: pearcmd.php present/readable (frequent on shared hosting, cPanel, official PHP Docker images), and register_argc_argv=On (default in PHP below 8.5). PHP 8.5 changed the default to Off. On a modern PHP 8.5+ server without PEAR, exploitation stops at LFI .

8. The patch – WordPress 7.1.2 adds two layers of defense: (a) the missing validate_file() call in the pagename branch, and (b) a new _wp_is_template_path_allowed() function called by locate_template() for every resolved template. The function rejects paths containing .., then resolves the real path via realpath() and verifies it lies inside one of the allowed theme directories. This defense-in-depth closes the sink, not just one route to it .

9. Active exploitation in the wild – First malicious requests observed 5 hours after patch release (17:44 UTC, Sept 22, 2026). Traffic increased tenfold over the next day. Three stages observed: config-show reconnaissance → core-file detection → config-create weaponization. Payload filenames included wp-pear-rce-flag.php, poc87902.php, luci_*.php, zeta_*.php, written to /tmp and /var/tmp. Attacking IPs: 169.58.48.193, 169.58.48.195, 2001:df1:e8c0::106b .

10. Impact – Code execution with web server privileges. Full site takeover, wp-config.php credential theft, data exfiltration, webshell installation, admin user creation, reverse shell, supply-chain attacks via modified plugins/themes, and lateral movement into connected services. The CVSS 9.2 score reflects network-exploitable, no-auth, high-confidentiality/integrity/availability impact. The high attack complexity reflects the theme and server preconditions, but on typical shared hosting those conditions are frequently met.

Affected Versions

• 4.7.0 – 4.7.37 – vulnerable
• 4.8.0 – 4.8.32 – vulnerable
• 4.9.0 – 4.9.33 – vulnerable
• 5.0.0 – 5.0.29 – vulnerable
• 5.1.0 – 5.1.26 – vulnerable
• 5.2.0 – 5.2.28 – vulnerable
• 5.3.0 – 5.3.25 – vulnerable
• 5.4.0 – 5.4.23 – vulnerable
• 5.5.0 – 5.5.22 – vulnerable
• 5.6.0 – 5.6.21 – vulnerable
• 5.7.0 – 5.7.19 – vulnerable
• 5.8.0 – 5.8.17 – vulnerable
• 5.9.0 – 5.9.18 – vulnerable
• 6.0.0 – 6.0.16 – vulnerable
• 6.1.0 – 6.1.14 – vulnerable
• 6.2.0 – 6.2.13 – vulnerable
• 6.3.0 – 6.3.12 – vulnerable
• 6.4.0 – 6.4.12 – vulnerable
• 6.5.0 – 6.5.12 – vulnerable
• 6.6.0 – 6.6.9 – vulnerable
• 6.7.0 – 6.7.9 – vulnerable
• 6.8.0 – 6.8.10 – vulnerable
• 6.9.0 – 6.9.9 – vulnerable
• 7.0.0 – 7.0.6 – vulnerable
• 7.1.0 – 7.1.1 – vulnerable

Patch

• Upgrade to 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, or 7.1.2 or newer.
• If upgrade is not possible, rename or remove the page-* directory in the active theme, set register_argc_argv=Off in php.ini, and block double-encoded traversal in the pagename parameter at the WAF level.

[<->] Tools

[</>] Feature Comparison

[+] Use Case Summary

[+] Installation

requirements.txt

[/] Parameters

exploit.py Parameters

safecheck.py Parameters

[>] Scenarios

🧪 Endpoint & Exploitation Chain

The exploit uses the following WordPress endpoints and exploitation steps:

Payload Format

🛡️ Responsible Use

• Only use these tools on systems you own or have explicit written permission to test.
• Unauthorized access is illegal and unethical.
• The authors are not responsible for any misuse.
• Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.