CVE-2026-87902

‼️ URGENT - WordPress issues patch a new critical flaw (CVE-2026-87902) that requires no account and can lead to code execution on some servers. Versions 4.7.0 through 7.1.1 are affected. Here's how the flaw works: https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html

Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab

@h4x0r_dz exploit here https://github.com/abraxas/CVE-2026-87902

🚨 WORDPRESS CRITICAL — UNAUTHENTICATED PAGE-TEMPLATE PATH TRAVERSAL CAN ENABLE RCE WordPress has issued a critical security release for CVE-2026-87902: an unauthenticated attacker can make page-template resolution include a chosen readable local PHP file outside the active theme directories. When server and theme pre-conditions are met, that can lead to remote code execution. • Severity: Critical — CVSS 9.2 (CVSS:4.0) • CVE / GHSA: CVE-2026-87902 / GHSA-7hp8-65ch-5whp • Affects: WordPress 4.7.0 through 7.1.1 (including last week’s 7.1.1) • Fix: WordPress 7.1.2 (and backports down to 4.7.37) • Pre-conditions for RCE: active theme has a top-level folder starting with page- (e.g. page-templates); a useful local .php target is readable (e.g. pearcmd.php when register_argc_argv is On) • Exploitation in the wild: none reported as of the advisory; not on CISA KEV • Credits: Robert Ressl (responsible disclosure) ⚠️ Analyst Note: This is the official http://WordPress.org 7.1.2 security release published September 22, 2026, with matching GHSA-7hp8-65ch-5whp. It is a separate flaw from the September 17 WordPress 7.1.1 Click2Shell fixes — sites that already updated to 7.1.1 still need 7.1.2. WordPress rates it critical and recommends updating immediately; automatic background updates will pull it where enabled. Official release: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ GHSA: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp #DDW #DarkWeb #CyberSecurity #ThreatIntelligence #WordPress #CVE

A PoC/exploit has been discovered for vulnerability CVE-2026-87902 PT ID: PT-2026-96839 Vendor: WordPress Product: WordPress Description: An unauthenticated attacker can make "get_page_template()" page-template resolution include a chosen readable local ".php" file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. References: • https://dbu.gs/vulnerability/PT-2026-96839 • https://github.com/ressl/cve-2026-87902-poc

@jaydrogers exploit - https://github.com/abraxas/CVE-2026-87902

🔴 WordPress Core'da CVE-2026-87902 kodlu, kimlik doğrulaması gerektirmeyen LFI açığı için @abraxas_null tarafından PoC yayınlandı. Açık, 7.1.1 ve önceki sürümleri etkiliyor ve şu an CVSS 8.1 (High) olarak değerlendiriliyor. Açığın uygun koşullarda RCE'ye dönüşebileceği belirtilirken, doğrudan bir reverse shell/RCE PoC'si değil. WordPress 7.1.2 veya sonraki sürümlere mutlaka güncelleme yapın. PoC: https://github.com/abraxas/CVE-2026-87902

Unauth WordPress LFI → PHP exec. Public PoC is live!!! CVE-2026-87902. get_page_template() builds page-{urldecode($pagename)}.php. locate_template() includes it with no theme-root jail. No account. Pair a page-templates/ theme with pearcmd.php (register_argc_argv=On) and you get two-request www-data RCE. Lab-verified Sept 22. Fixed in 7.1.2 / backports to 4.7.37. https://github.com/ressl/cve-2026-87902-poc #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WordPress #RCE #BugBounty

brand new wordpress core release, brand new exploit. get it while it's hot! unauthorized local file inclusion; conditional RCE https://github.com/abraxas/CVE-2026-87902

@TheHackersNews exploit.. https://github.com/abraxas/CVE-2026-87902

New unauthenticated no user interaction RCE in WordPress. Some pre-conditions. Not click2shell. CVE-2026-87902 Ensure auto-updates enabled. Update to 7.1.2.

🚨 WordPress 7.1.2 yayınlandı. Sürümde CVE-2026-87902 kodlu, CVSS 9.2 Critical*seviyesinde kritik güvenlik açığı giderildi. Açık, kimlik doğrulaması gerektirmeyen Path Traversal yoluyla get_page_template() fonksiyonunun tema dizinleri dışındaki yerel .php dosyalarını dahil etmesine neden olabiliyordu. Belirli sunucu ve tema koşullarında RCE ile sonuçlanabiliyordu. Etkilenen: WordPress 7.1.0–7.1.1 Fixed / Yamalanmış sürüm: 7.1.2 Açık ayrıca eski desteklenen WordPress branch'lerine backport edildi. https://wordpress.org/download/

CVE-2026-87902: Path Traversal in WordPress leading to RCE, 9.2 Rating 🔥 Another newly disclosed WordPress RCE vulnerability allows an unauthenticated attacker to execute arbitrary code under specific server conditions. 👉 https://nt.ls/B4TJE

‼️ تحذير لمستخدمين WordPress حدث نسختك الان تم الاعلان عن ثغره خطيرة تسمح للمهاجم بتنفيذ اوامر عن بعد في الصورة الإصدارات المصابة رقم الثغرة CVE-2026-87902 https://t.co/xHfpkljmeC

@WordPress exploit for mentioned vulnerability: https://github.com/abraxas/CVE-2026-87902

‼️ Vairākās WordPress versijās atklāta kritiska ievainojamība CVE-2026-87902 (CVSS 9.2). Aicinām pēc iespējas ātrāk atjaunināt WordPress uz versiju 7.1.2, vai citu (labojumi pieejami arī vecākām versijām līdz pat 4.7). Vairāk: https://cert.lv/lv/2026/09/kritiska-wordpress-ievainojamiba-cve-2026-87902 https://t.co/9yEGBxob45

Critical WordPress Core flaw I discovered: CVE-2026-87902. 9.2/10 (CVSS 4.0). Unauthenticated local PHP file inclusion with conditional RCE. Fixed in 7.1.2, with backports. Update your site. PoC + lab: https://github.com/ressl/cve-2026-87902-poc #WordPress https://t.co/hOSpnRjPMI

@abraxas_null @TheHackersNews https://ressl.ch/blog/cve-2026-87902-wordpress/ https://github.com/ressl/cve-2026-87902-poc

🚨 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal Nuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml Reference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp #hackwithautomation #bugbounty #wordpress https://t.co/GAC3YpllZ5

🚨 CRITICAL: CVE-2026-87902 (CVSS 9.2) is an unauthenticated WordPress Core vulnerability that can lead to remote code execution under specific conditions. The flaw in page-template resolution can allow an attacker to make WordPress include a readable local PHP file outside the active theme directory. ⚠️ Exploitation depends on specific theme and server configurations, but no authentication is required. 🔴 WordPress 7.1.2 fixes the vulnerability. Update immediately. 🔗 https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ #WordPress #CVE #RCE #CyberSecurity #Infosec