EXPLOIT-CVE-2026-87902

Lab + Exploit — CVE-2026-87902 Lab deliberadamente vulnerable + PoC en Python para la CVE-2026-87902 : path traversal no autenticado en la resolución de page template del WordPress Core , que conduce a Local File Inclusion LFI y a RCE condicional. Campo| Valor ---|--- Producto| WordPress Core...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Laboratorio de validación de LFI no autenticado en Visual Composer mediante vcv-template Material de investigación de seguridad para reproducir y validar CVE-2026-12227 : una inclusión local de archivos no autenticada en la resolución de plantillas de página del Visual Composer...

cve-2026-87902-detection

wp-ghsa-7hp8-lab Herramientas de detección y banco de pruebas reproducible para GHSA-7hp8-65ch-5whp / CVE-2026-87902 — unauthenticated path traversal in page-template resolution leading to conditional RCE WordPress, CWE-98, CVSS 4.0: 9.2...

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...

Exploit for CVE-2026-87902

wp-ghsa-7hp8-lab Outillage de détection et banc d'essai repro...

VulnCheck KEV: CVE-2026-87902

An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...