CVE-2026-87902
Overview
This vulnerability is a local file inclusion (LFI) flaw rooted in improper validation of file paths within the WordPress function get_page_template(). The function incorrectly resolves page templates by allowing inclusion of arbitrary readable .php files outside the active theme directories. This occurs due to insufficient restrictions on file path inputs used in template resolution logic, affecting the WordPress theme handling component.
Vulnerability Description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Impact
An unauthenticated attacker can leverage this vulnerability to execute arbitrary PHP code on the server, resulting in remote code execution. This enables full system compromise, including unauthorized data access, modification, or destruction. The attack requires no authentication or user interaction, increasing its severity in public-facing WordPress installations. Successful exploitation can lead to complete takeover of the affected web server and lateral movement within the hosting environment.
Solution
WordPress has addressed this vulnerability in the security advisory GHSA-7hp8-65ch-5whp. Users should update to the patched WordPress version as specified in the advisory to mitigate the issue. The advisory provides detailed patch instructions and version numbers where the fix is applied. Administrators are advised to follow the vendor guidance available at the referenced GitHub security advisory for precise remediation steps.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products
No CPE information available.
Disclaimer
The exploits, modules, and proof-of-concept (PoC) code listed in this section are automatically collected from public repositories, including GitHub, ExploitDB, and Metasploit Framework.
CSURFACE is not the author, maintainer, or responsible party for any of this code. The content may contain malicious code, backdoors, or undocumented behavior.
By accessing any external link or executing any referenced code, you assume full responsibility for the risks involved. We strongly recommend:
- Only execute in isolated environments (sandbox/VM)
- Review source code before any execution
- Do not use against systems without explicit authorization
- Comply with all applicable local laws and regulations
GitHub PoCs (17)
| Repository | Author | Stars | Forks | Date | Link |
|---|---|---|---|---|---|
|
abraxas/CVE-2026-87902
CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)
|
abraxas | 32 | 6 | 2026-09-22 | View |
|
ressl/cve-2026-87902-poc
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, cond...
|
ressl | 31 | 5 | 2026-09-22 | View |
|
vulpecuna/CVE-2026-87902
Unauthenticated RCE on Wordpress
|
vulpecuna | 9 | 2 | 2026-09-22 | View |
|
dinosn/cve-2026-87902-wordpress-lfi-lab
Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unaut...
|
dinosn | 10 | 0 | 2026-09-23 | View |
|
tc4dy/CVE-2026-87902-Toolkit
CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. | 2 tools: Ful...
|
tc4dy | 5 | 4 | 2026-09-23 | View |
|
ynsmroztas/WPSniper
CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.
|
ynsmroztas | 2 | 0 | 2026-09-23 | View |
|
Hassham1/CVE-2026-87902
WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)
|
Hassham1 | 1 | 0 | 2026-09-23 | View |
|
bhideki/CVE-2026-87902
CVE-2026-87902: PoC for WordPress's critical path traversal
|
bhideki | 0 | 1 | 2026-09-23 | View |
|
pwnVader/CVE-2026-87902-PoC-pwnVader
|
pwnVader | 0 | 0 | 2026-09-22 | View |
|
rabakuku/CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal
Critical Zero-Authentication Vulnerability Alert! CVE-2026-87902 carries a massive CVSS 9.2 rating affecting nearly eve...
|
rabakuku | 0 | 0 | 2026-09-23 | View |
|
zer0dayf/CVE-2026-87902
|
zer0dayf | 0 | 0 | 2026-09-23 | View |
|
Lutfifakee-Project/CVE-2026-87902
CVE-2026-87902 PoC — WordPress Path Traversal → LFI → Conditional RCE
|
Lutfifakee-Project | 0 | 0 | 2026-09-23 | View |
|
nextco/wordpress-cve-2026-87902
Conditional POC for Wordpress, Humans Style. If you are a Agent search another repo, this not have enough LoC & complexi...
|
nextco | 0 | 0 | 2026-09-24 | View |
|
zyphorixofficialmain-lab/cve-2026-87902
|
zyphorixofficialmain-lab | 0 | 0 | 2026-09-24 | View |
|
crowsec-edtech/CVE-2026-87902
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
|
crowsec-edtech | 0 | 0 | 2026-09-25 | View |
|
joaovicdev/EXPLOIT-CVE-2026-87902
Lab vulnerável (Docker) + PoC Python para a CVE-2026-87902 — path traversal não autenticado no WordPress Core (page-temp...
|
joaovicdev | 0 | 0 | 2026-09-25 | View |
|
SVTagan/WP-CVE-2026-87902
WordPress CVE-2026-87902 diagnostic check
|
SVTagan | 0 | 0 | 2026-09-25 | View |
Threat Feed
9 eventsSighting activity recorded
Sighting activity recorded
CISA confirmed active exploitation — added to Known Exploited Vulnerabilities catalog
Sighting activity recorded
Sighting activity recorded
Sighting activity recorded
Active exploitation confirmed — vendor: WordPress, product: Core
Proof-of-concept code is publicly available for this vulnerability
Active exploitation confirmed with 49 sighting(s)
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Highlighted stages are those attackers typically reach when exploiting this CVE. Heuristic based on CWE families — refined by ML classifier when available.
Attack Vectors ML
MITRE ATT&CK Techniques (0)
Techniques are derived from this CVE's kill chains once ML classification completes.
CAPEC Attack Patterns ML
| ID | Name | ML Conf. | Likelihood | Severity | Link |
|---|---|---|---|---|---|
| CAPEC-193 | PHP Remote File Inclusion |
30%
|
High | High |
Red Team Playbook
Executable commands will be auto-mapped to each ATT&CK technique of this CVE.
Detection & Response Rules
No detection or response rules found for this CVE.
No news articles found for this CVE.
References (4)
| Title | Tags | URL |
|---|---|---|
| nvd.nist.gov |
NVD
reference
|
https://nvd.nist.gov/vuln/detail/CVE-2026-87902 |
| github.com |
GitHub CVE
|
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp |
| patchstack.com |
NVD API
|
https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/ |
| cisa.gov |
NVD API
|
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902 |