CVE-2026-87902-PoC-pwnVader

CVE-2026-87902 — Unauthenticated local file inclusion in WordPress core page-template resolution → RCE Author: pwnVader · License: MIT repository root | ---|--- Component| WordPress core wp-includes/template.php Type| CWE-98 — PHP file inclusion LFI → RCE Affected| WordPress 7.1.2 7.0 branch fixe...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Visual Composer Unauthenticated LFI via vcv-template Validation Lab Security-research material for reproducing and validating CVE-2026-12227 : an unauthenticated local file inclusion in Visual Composer Website Builder's page-template resolution CVSS 3.1 9.8, plus a verified...

EXPLOIT-CVE-2026-87902

Lab + Exploit — CVE-2026-87902 Lab deliberately vulnerable + Python PoC for CVE-2026-87902 : unauthenticated path traversal in the page template resolution of WordPress Core , leading to Local File Inclusion LFI and conditional RCE. Field| Value ---|--- Product| WordPress Core Affected versions|...

Fedora 44 : wordpress (2026-7f9c69a63c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7f9c69a63c advisory. WordPress 6.9.9 Security Release Security updates included in this release - Unauthenticated path traversal in page-template resolution leading to conditiona...

Fedora 45 : wordpress (2026-c7024b3255)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c7024b3255 advisory. WordPress 7.1.2 Security Release Security updates included in this release - Unauthenticated path traversal in page-template resolution leading to conditiona...

WordPress Core Remote File Inclusion Vulnerability

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution...

Exploit for CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Vali...

cve-2026-87902-detection

wp-ghsa-7hp8-lab Herramientas de detección y banco de pruebas reproducible para GHSA-7hp8-65ch-5whp / CVE-2026-87902 — unauthenticated path traversal in page-template resolution leading to conditional RCE WordPress, CWE-98, CVSS 4.0: 9.2. | ---|--- check/| Controlador remoto, pasivo, sin acceso a...

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...

Exploit for CVE-2026-87902

wp-ghsa-7hp8-lab Outillage de détection et banc d'essai repro...

VulnCheck KEV: CVE-2026-87902

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution...