Loading vulnerability…
CVE-2026-87902 is a critical improper filename-validation vulnerability in WordPress page-template resolution. An attacker-controlled component of a request can be incorporated into a page-template filename without effective traversal validation, allowing an unauthenticated attacker to cause inclusion of a chosen readable local PHP file outside the active theme directories. The issue affects WordPress versions 4.7.0 through 7.1.1. Inclusion can produce remote code execution when a suitable server-resident PHP execution primitive and the necessary server and theme conditions are present.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This nine-file repository contains a Python 3 proof of concept and an isolated Docker lab for CVE-2026-87902, an alleged unauthenticated WordPress Core page-template resolution flaw. The primary entry point, `cve-2026-87902.py`, discovers a published Page through the WordPress REST API unless a page ID is supplied, then sends anonymous POST requests with a double-encoded `pagename` traversal. The traversal survives early WordPress pathname sanitization, is decoded later in template selection, and is intended to cause inclusion of a readable PHP file outside allowed theme roots. The script implements a two-stage optional RCE chain: it first includes PEAR's `pearcmd.php` to create a PHP file in a writable directory, then includes that file and checks the response for its marker. `docker-compose.yml`, `lab/Dockerfile`, and `lab/up.sh` build and configure a WordPress 7.0.2/PHP 8.3/Apache plus MySQL 8.4 lab, expose it only on localhost, enable `register_argc_argv`, create the necessary `page-templates` fixture, and provide a root-owned readable `/flag` proof file. The repository is not part of a recognized exploit framework.
This 12-file repository is a self-contained local proof-of-concept and Docker lab for CVE-2026-87902, an alleged unauthenticated local file inclusion issue in WordPress Core template resolution. The main Python entry point, CVE-2026-87902-Abraxas-Labs.py, sends HTTP GET requests to a supplied base URL and page ID. Its attack request supplies a double-URL-encoded traversal sequence in pagename, intended to escape the active theme's template directory and include wp-content/uploads/ghsa7hp8-witness.php. It does not provide a shell, command execution payload, persistence, credential theft, or scanning functionality; its sole included payload is a PHP marker file used as an inclusion oracle. The lab directory contains Docker Compose infrastructure for wordpress:7.1.1-php8.2-apache and MySQL 8.0, bound at 127.0.0.1:18092, plus a Bash setup script. The setup installs WordPress, activates a minimal classic PHP theme with page-templates/, creates a published page if needed, writes the witness PHP file to uploads, and invokes the Python PoC. Minimal PHP theme files and witness.php support reproducible validation. The Python code checks both a normal control request and a direct witness request to distinguish the intended WordPress template-loader inclusion from ordinary direct access. No exploit framework is used.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical WordPress path-traversal/file-inclusion vulnerability in get_page_template() that can permit remote code execution by loading arbitrary existing PHP files outside the intended template directory. Exploitation requires the top-level directory containing the used template to begin with "page-"; this condition is reportedly common in certain WordPress and third-party templates.
A critical unauthenticated WordPress core template-selection path traversal/local PHP file inclusion flaw. An attacker can cause a site to load a PHP file outside theme folders; under certain server and theme conditions, this can be escalated to execution of attacker-controlled code.
A critical WordPress page-template resolution vulnerability that lets an unauthenticated attacker cause inclusion of a chosen readable local PHP file outside active theme directories. Where server- and theme-specific preconditions are satisfied, the issue can lead to remote code execution.
A path-traversal vulnerability identified as affecting WordPress. The content only references creation of a template for the CVE and provides no technical details, affected versions, or impact information.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.