CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal

🚨 CVE-2026-87902: WordPress Core Unauthenticated Path Traversal & RCE Mitigation 🔴 Watch the Full Breakdown & Mitigation Tutorial: 👉 Click Here to Watch on YouTube 📖 Overview This repository provides emergency reference notes, web server mitigation rules, and hardening configs covered in our...

CVE-2026-87902

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-87902 CVE-2026-87902 WordPress Core 7.1.1 - WordPress I am @abraxasnull. Loopback lab. The client is CVE-2026-87902-Abraxas-Labs.py. Unauthenticated LFI via locatetemplate. getpagetemplate builds...

CVE-2026-87902

CVE-2026-87902 — PoC: unauthenticated path traversal in WordPress page-template resolution Exploit file: exploitlocatetemplaterce.py — Python 3.6+ stdlib only. Single-command pipeline: safe detection LFI differential, no writes →, if vulnerable, RCE via the pearcmd.php gadget executing the comman...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core · LFI → RCE Exploit no aute...

Exploit for CVE-2026-87902

CVE-2026-87902 — PoC: path traversal não autenticado na resolu...

Exploit for CVE-2026-87902

CVE-2026-87902 — PoC Unauthenticated remote code execution...

Exploit for CVE-2026-87902

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-2448: Improper Limitation of a Pathname to a Restricted Directory

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locatetemplate function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary fil...

CVE-2024-11642: Improper Limitation of a Pathname to a Restricted Directory

The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.4.12 via the 'locatetemplate' function. This makes it...