---

🔍 Overview

A modern Tkinter GUI (standard library only, no third-party dependencies) for CVE-2026-87902 — an unauthenticated Local File Inclusion in WordPress core via the pagename parameter of get_page_template(), escalated to Remote Code Execution through a PEAR gadget chain (pearcmd.php + config-create).

• Affected: WordPress 4.7.0 – 7.1.1
• Fixed in: 6.8.10, 7.0.6, 7.1.2
• CVSS: 9.8 — CWE: 22 — GHSA: 7hp8-65ch-5whp

---

✨ Features

• 🎯 Single & mass scanning — one target or a URL list from a file, multi-threaded
• 🔎 Fingerprinting — detects WordPress, core version, and active theme
• 🧪 Non-destructive check — check-only mode confirms the LFI without executing anything
• 💥 LFI → RCE — brute-forces pearcmd.php (Linux + XAMPP/Windows) across depths 1–19, writes PHP via config-create
• 📁 File Manager deployment — drops fm_<hex>.php into the configured drop directory once RCE succeeds
• 🛡️ False-positive guard — negative-control probe on the OPML oracle (detects ambient output)
• 🎨 Hacker Console UI — dark-neon theme, matrix rain, colour-coded console, live stats, progress bar
• 📊 CSV export — dump the full result set to CSV

---

📦 Requirements

• Python 3.8 or newer
• No pip install needed — pure standard library (tkinter, urllib, ssl, socket, gzip, zlib, threading, queue, ...)

If Tkinter is missing on your system (this is an OS package, not a pip package):

Platform	Command
Debian / Ubuntu	sudo apt install python3-tk
Fedora / RHEL	sudo dnf install python3-tkinter
Arch Linux	sudo pacman -S tk
macOS (Homebrew)	brew install python-tk
Windows	Bundled with the official Python installer

---

⚡ Quick Start

git clone https://github.com/tonydelouvre/CVE-2026-87902.git
cd CVE-2026-87902
python3 xwp_gui.py

Keyboard shortcuts:

Key	Action
Ctrl+Enter	Start scan
Esc	Stop scan

---

🎯 Usage

1. TARGET — choose SINGLE (one URL) or MASS, then BROWSE LIST a .txt file containing one URL per line.
2. MODE — tick exploit -> RCE and deploy file manager for the full chain, or check-only for a safe verification pass.
3. ADVANCED — tune oracle, depths, segments, probe, threads, timeout, proxy.
4. Hit START SCAN and watch the CONSOLE and RESULTS tabs.

Configuration fields

Field	Default	Description
target url	–	Target base URL (single mode)
target list	–	File of URLs (mass mode)
command	id	Command executed once RCE is achieved
drop dir	/tmp	Directory where the File Manager is written
oracle	wp-links-opml	Core file abused as the LFI oracle
depths	4,3,5,6,7	../ traversal depths to try
segments	templates,templates/page-templates,page-templates	Theme page-* directories
probe	12	Number of page_id values to probe
threads	10	Parallel workers (max 50)
timeout	12.0	Per-request timeout in seconds
max time	60.0	Time budget per target in seconds
proxy	–	http://host:port

Payload construction

build_pagename() produces segment + %252f + N× %252e%252e%252f + target, applying double URL-encoding:

/?page_id=<N>&pagename=templates%252f%252e%252e%252f...%252fwp-links-opml

---

🔬 How It Works

Phase	Module	Action
1. Fingerprint	Fingerprinter	Detect WordPress + version (generator, ?ver=, wp-links-opml.php) and theme
2. Precondition	PreconditionChecker	Locate the theme page-* directory used as the traversal segment
3. Discovery	PageDiscoverer	Collect page_id values via REST API, sitemaps, shortlinks, page-id- classes
4. LFI	TraversalExploiter	Request ?page_id=N&pagename=<double-encoded path> and look for the <opml version= oracle
5. RCE	RCEEscalator	Locate a pearcmd.php gadget at depth 1–19, write PHP via pear +config-create+, execute the command
6. Post-exploit	shell.php	Deploy the File Manager (fm_<hex>.php) into the drop directory

Version shortcuts: if the fingerprint reports patched or out_of_range, the target is skipped immediately to save time.

---

🖥️ Output

The RESULTS tab shows the columns target, verdict, version, lfi, rce, shell. Rows classified VULNERABLE are highlighted in cyan; rows that achieved RCE turn magenta. EXPORT writes everything to CSV:

target,verdict,version,lfi,rce,shell,detail
http://target.local,VULNERABLE,6.4,templates/../../ d=4 POST,uid=33(www-data),http://target.local/?page_id=2&pagename=...,

---

🛡️ Mitigation

For system administrators:

1. Update WordPress to 7.1.2 or later (backports: 6.8.10, 7.0.6, 7.1.2).
2. Add a WAF rule blocking requests whose pagename contains ../ or %2e%2e.
3. Disable register_argc_argv in php.ini — this breaks the PEAR gadget chain.
4. Remove pearcmd.php if PEAR is not required.

; php.ini
register_argc_argv = Off

⚖️ Legal Disclaimer

FOR AUTHORIZED SECURITY TESTING ONLY

This tool is provided exclusively for penetration testing and security research with prior written consent. Using it against targets without explicit authorisation is: