CVE-2026-87902 PoC — WordPress Path Traversal → LFI → Conditional RCE

WordPress get_page_template() — Unauthenticated Path Traversal → Local File Inclusion → Conditional RCE

A security research tool for detecting and testing CVE-2026-87902 / GHSA-7hp8-65ch-5whp, including vulnerability scanning and authorized single-target testing.

Important: Only use this project against systems you own or systems for which you have explicit authorization to perform security testing.

---

Vulnerability Overview

CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress page-template resolution involving the get_page_template() function.

An unauthenticated attacker can manipulate the pagename parameter so that WordPress resolves a local PHP file outside the expected active-theme page-template directory.

This can result in:

• Local File Inclusion (LFI) — inclusion of a chosen readable local PHP file.
• Conditional Remote Code Execution (RCE) — under specific server and theme conditions, the LFI primitive can potentially be chained into code execution.

According to the official WordPress security advisory, successful RCE requires additional environmental and theme-specific prerequisites.

RCE Prerequisites

The official advisory identifies conditions including:

1. The active parent or child theme contains a top-level directory whose name begins with page-.
2. A suitable local PHP file exists and is readable by the web-server account.
3. For the commonly referenced pearcmd.php transition, register_argc_argv must be enabled.
4. The relevant server environment must otherwise satisfy the conditions required by the exploitation chain.

Therefore, not every vulnerable WordPress installation is automatically exploitable for RCE.

---

Vulnerability Information

Item	Details
CVE	CVE-2026-87902
GHSA	GHSA-7hp8-65ch-5whp
CWE	CWE-98
Severity	Critical
CVSS v4.0	9.2
Affected Software	WordPress
Attack Type	Unauthenticated Path Traversal / Local File Inclusion
RCE	Conditional, environment-dependent
Disclosure	September 2026

The official advisory identifies CWE-98 and a CVSS v4.0 base score of 9.2.

---

Affected Versions

The vulnerability affects the following WordPress branches:

Branch	Affected	Fixed
7.1	7.1.0 – 7.1.1	7.1.2
7.0	7.0.0 – 7.0.5	7.0.6
6.9	6.9.0 – 6.9.8	6.9.9
6.8	6.8.0 – 6.8.9	6.8.10
6.7	6.7.0 – 6.7.8	6.7.9
6.6	6.6.0 – 6.6.8	6.6.9
6.5	6.5.0 – 6.5.11	6.5.12
6.4	6.4.0 – 6.4.11	6.4.12
6.3	6.3.0 – 6.3.11	6.3.12
6.2	6.2.0 – 6.2.12	6.2.13
6.1	6.1.0 – 6.1.13	6.1.14
6.0	6.0.0 – 6.0.15	6.0.16
5.9	5.9.0 – 5.9.17	5.9.18
5.8	5.8.0 – 5.8.16	5.8.17
5.7	5.7.0 – 5.7.18	5.7.19
5.6	5.6.0 – 5.6.20	5.6.21
5.5	5.5.0 – 5.5.21	5.5.22
5.4	5.4.0 – 5.4.22	5.4.23
5.3	5.3.0 – 5.3.24	5.3.25
5.2	5.2.0 – 5.2.27	5.2.28
5.1	5.1.0 – 5.1.25	5.1.26
5.0	5.0.0 – 5.0.28	5.0.29
4.9	4.9.0 – 4.9.32	4.9.33
4.8	4.8.0 – 4.8.31	4.8.32
4.7	4.7.0 – 4.7.36	4.7.37

These affected and patched versions are taken from the official WordPress security advisory.

---

Credits

• Vulnerability Researcher / Original Discoverer: Robert Ressl
• Original PoC: ressl/cve-2026-87902-poc
• Scanner + Tool Author: Lutfifakee-Project
• Advisory: WordPress Security Team

The vulnerability was discovered and responsibly disclosed by Robert Ressl. This repository provides a separate scanner and testing tool based on the publicly documented vulnerability.

---

Features

• Fast mass scanning

  • Multiple targets
  • Concurrent workers
  • Fast vulnerability oracle
  • URL file input
  • STDIN support

• Deep single-target scanning

  • Multiple detection oracles
  • Multiple encodings
  • Multiple HTTP methods
  • Comparative oracle validation

• WAF detection

  • Wordfence
  • Cloudflare
  • Imperva
  • Sucuri
  • Akamai
  • AWS WAF
  • F5

• Theme discovery

  • WordPress SVN lookup
  • HTML-based discovery
  • HEAD request fallback

• LFI testing

  • Controlled local-file inclusion validation
  • WordPress core file oracle
  • Readable PHP-file testing

• Conditional RCE testing

  • PEAR-based transition testing
  • Environment-aware checks
  • Designed for authorized testing only

• Structured output

  • Console output
  • Full log files
  • Vulnerable-only output
  • JSON
  • JSONL

• Cross-platform

  • Linux
  • macOS
  • Windows 10+

---

Requirements

• Python 3.7 or newer
• Tested with Python 3.10 – 3.13
• Python Standard Library only

No third-party Python packages are required.

---

Installation

git clone https://github.com/Lutfifakee-Project/CVE-2026-87902.git
cd CVE-2026-87902

python cve-2026-87902.py --help

---

Usage

Mass Scan

Scan multiple authorized targets from a file:

python cve-2026-87902.py -f urls.txt --threads 30 --vuln-only vuln.txt -o results.txt

Deep Scan

Run deeper validation against a single authorized target:

python cve-2026-87902.py http://localhost:8081 --deep -v

Authorized Testing

Testing modes that can perform active exploitation require the explicit authorization flag:

python cve-2026-87902.py http://localhost:8081 --rce "id" --i-have-authorization

File Inclusion Testing

python cve-2026-87902.py http://localhost:8081 --read wp-config.php --i-have-authorization

Multiple File Checks

python cve-2026-87902.py http://localhost:8081 --files /etc/passwd /etc/hosts --i-have-authorization

Use active exploitation functionality only in an environment where you have explicit permission to conduct the test.

---

Local Test Environment

For controlled local testing, you can run a vulnerable WordPress environment:

docker run --rm -d -p 8081:80 wordpress:7.0.2-php8.3-apache

Then test the local instance:

python cve-2026-87902.py http://localhost:8081 --deep -v

The official advisory notes that the official PHP Docker image can satisfy the environment conditions relevant to the pearcmd.php transition.

---

Command-Line Options