cve-2026-87902

Python exploit for CVE-2026-87902, a WordPress Core LFI-to-RCE chain. Fingerprints versions, writes a PHP shell via pearcmd, and provides command execution or LFI fallback.

RCE Preconditions

For full RCE, all of the following must be true:

1. WordPress version between 4.7.0 and 7.1.1
2. Active theme contains a top-level page-* directory (e.g. page-templates/)
3. At least one published page exists
4. pearcmd.php is present and readable by the web server user (default in official PHP Docker images and many cPanel installs with PHP < 8.5)
5. PHP has register_argc_argv=On (default in PHP < 8.5)
6. Host OS is Linux (Windows traversal syntax differs)

If any of these are missing, the exploit will fall back to LFI-only file read.

📂 Files

exploit.py # Main exploit script README.md # This file report.json # (optional) Output report when -o is used

⚙️ Requirements

• Python 3.8+
• requests library

Install:

1. Basic scan (verbose)

This will:

· Fingerprint WordPress version and active theme · Verify vulnerable version range · Locate a published page ID (REST → sitemap → brute force) · Attempt to write a PHP shell via pearcmd.php · Attempt to include the shell and execute id · If RCE fails, fall back to LFI on sensitive files

2. Execute a single command

3. Interactive shell (only if RCE succeeded)

Inside the shell:

4. Save report to JSON

5. Combine options

🧾 CLI Reference

Flag Long Description -t --target Required. Target WordPress URL (no trailing slash). -c --command Execute a single shell command after RCE. -i --interactive Open an interactive shell after RCE. -v --verbose Print detailed progress. -o --output Save the final report as JSON to the given path. -h --help Show help.

🔄 Exploit Flow