CVE-2026-87902

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-87902 8.1

WordPress · Core · Added 2026-09-25 · Published 2026-09-22

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityWordPress Core Remote File Inclusion Vulnerability

VendorWordPress

ProductCore

Date added2026-09-25

Due date2026-09-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-98

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.

NVD: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-25 20:21 UTC

Wall time1.0s

Searches2

Component defaultyes

Sources https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
https://github.com/bhideki/CVE-2026-87902
https://github.com/tc4dy/CVE-2026-87902-Toolkit
https://github.com/oliveiralimajr/CVE_2026_87902
https://github.com/joaovicdev/EXPLOIT-CVE-2026-87902
https://nvd.nist.gov/vuln/detail/CVE-2026-87902

Hunting hypothesis agent

Hunt access logs and WAF rules for unauthenticated page-template traversal via get_page_template(): pagename values like templates%2f%252e%252e%252f...pearcmd sent with page_id to / or /index.php, and pearcmd/+config-create query strings.

Research details

Componentget_page_template() page-template resolution in wp-includes/template.php (pagename query variable feeding the locate_template() include sink)

PreconditionsUnauthenticated network access to the target site via GET or POST (no auth, no user interaction); unpatched WordPress 4.7.0-7.1.1 (fixed in 7.1.2 with backports to 4.7.37); active classic theme with a top-level directory starting with 'page-' (e.g. page-templates, as in Twenty Twelve/Fourteen, Neve, Hestia, Sydney) plus a published page using the default template; target file must be a readable .php file for the web-server user on a Linux host (Windows path handling is immune). RCE additionally requires readable PEAR pearcmd.php and register_argc_argv=On (default before PHP 8.5; official Docker php image and stock cPanel are affected). agent

DeliveryUnauthenticated HTTP GET or POST to the site root or /index.php carrying a double-encoded traversal (e.g. templates%2f%252e%252e%252f...) in the pagename parameter paired with a valid page_id

Public PoCyes

PoC URLs https://github.com/bhideki/CVE-2026-87902
https://github.com/tc4dy/CVE-2026-87902-Toolkit
https://github.com/oliveiralimajr/CVE_2026_87902
https://github.com/joaovicdev/EXPLOIT-CVE-2026-87902 Third-party repos; verify before use.

Advisoryhttps://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

Exploit notesKEV lists CVSS 3.1 8.1 (AC:H); the vendor advisory rates CVSS 4.0 9.2 (AC:L). Functional public PoCs confirmed: Python scanners/LFI checkers with a PEAR pearcmd.php RCE chain and a Docker reproduction lab (all four repos read). Patchstack observed active exploitation from 2026-09-22 11:49 UTC escalating to pearcmd file writes, with named user agents cve-2026-87902-poc/1.0 and nuclei-cve-2026-87902/1.0 in general circulation. The LFI itself needs only an unpatched classic-theme install meeting the page- directory precondition; RCE needs pearcmd.php plus register_argc_argv=On. Traversal payloads travel in POST bodies as often as query strings, which stock Apache/IIS access logs do not record — WAF capture or a custom log format is needed for the POST variant.

SummaryWordPress Core's get_page_template() page-template resolution in wp-includes/template.php urldecodes the pagename query variable after sanitization without re-running validate_file(), so an unauthenticated attacker can double-encode a ../ traversal and include an arbitrary readable local .php file outside the active theme (CWE-98), reaching RCE via the PEAR pearcmd.php gadget when register_argc_argv=On. WordPress released 7.1.2 plus backports to 4.7.37 on 2026-09-22 under GHSA-7hp8-65ch-5whp, reported by Robert Ressl. Patchstack observed exploitation the same day, escalating from core-file inclusion probes to pearcmd file writes in /tmp, with multiple functional public PoCs and a named Nuclei template circulating.

Tia coverage

First reported2026-09-22

First exploit report2026-09-24

Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

wordpress-7-1-2-patches-a-critical-wordpress-rce-vulnerability-c

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.