WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)

Security researcher Robert Ressl released a verified proof-of-concept for CVE-2026-87902, an unauthenticated path traversal and local file inclusion (LFI) flaw in WordPress Core's page-template resolution. A double-encoded traversal payload in the pagename parameter bypasses initial sanitization, allowing arbitrary local .php files to be included. In environments with PEAR and register_argc_argv=On, attackers can chain pearcmd.php to write PHP payloads to disk and achieve unauthenticated remote code execution.

While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.