abraxas/cve-2026-87902Proof-of-concept and disclosure pack for CVE-2026-87902, an unauthenticated local file inclusion in WordPress Core via locate_template(), with a loopback lab and patch guidance.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · CVE-2026-87902
WordPress Core 7.1.1 - WordPress
I am @abraxas_null. Loopback lab. The client is CVE-2026-87902-Abraxas-Labs.py.
Unauthenticated LFI via locate_template(). get_page_template() builds page-{$pagename}.php from urldecoded pagename. locate_template() concatenates onto the theme directory without a jail. Classic theme with a top-level page-* directory (page-templates). 7.1.2 adds _wp_is_template_path_allowed() and validate_file on the decoded pagename. Backported through 4.7.37.
| CVE | CVE-2026-87902 · CVE.org |
| CWE | CWE-98 |
| CVSS | Critical: 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Product | WordPress Core |
| Affected | all versions through 7.1.1 (inclusive) |
| Patched | 7.1.2 and later |
| Auth | unauthenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
GET a published page with double-encoded pagename walking out of the theme into a readable local .php. That file is included in the front-end response. Lab oracle is a witness PHP under uploads that also prints wp_version. Direct GET of the uploads file is not the bug (no wp_version). Not pearcmd.
I mapped template.php get_page_template + locate_template on 7.1.1, then a classic theme with page-templates, then a readable uploads PHP.
Control GET /?page_id=N must not contain the witness. Attack GET with double-encoded pagename must contain GHSA7HP8-WITNESS and wp_version=7.1.1.
Fail-controls already in the lab: witness only on a direct GET of the uploads PHP (wp_version=none); reverse shell; pearcmd.php gadget.
Port 18092. WordPress 7.1.1. Classic theme with page-templates. lab/witness.php planted under uploads. ./run.sh.
Target only 127.0.0.1:18092 (or the loopback you bound).
cd lab
docker compose up --force-recreate
python3 ../CVE-2026-87902-Abraxas-Labs.py
Witness: Unauthenticated 200 body contains GHSA7HP8-WITNESS and wp_version=7.1.1. Control GET /?page_id=N does not.
Ways to lose without learning anything:
wp_version=none)Update WordPress to 7.1.2 or newer. Re-run CVE-2026-87902-Abraxas-Labs.py against the patched build: the page response must not include the uploads PHP.
github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
GNU Affero GPL v3.0. See LICENSE.
The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.