Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2026-87902 [High]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-87902.

Vendor
WordPress
Product
WordPress Core
Affected versions
4.7.0 - 7.1.1
CVSS
8.1
Coverage Span
2026-09-22
Reports
1 related reports

Associated Reports & Timeline

1.
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
github.com | vulnerability | High | | original ↗ | #bug-bounty | #rce | #wordpress | #path-traversal
Security researcher Robert Ressl released a verified proof-of-concept for CVE-2026-87902, an unauthenticated path traversal and local file inclusion (LFI) flaw in WordPress Core's page-template resolution. A double-encoded traversal payload in the pagename parameter bypasses initial sanitization, allowing arbitrary local .php files to be included. In environments with PEAR and register_argc_argv=On, attackers can chain pearcmd.php to write PHP payloads to disk and achieve unauthenticated remote code execution.
Why it matters: While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.