wordpress-cve-2026-87902

CVE-2026-87902 — Conditional LFI Love for Humans - Keep Simple WordPress Core +/tmp/pwn.php' curl -s 'http://10.137.137.49:18092/?pageid=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Ftmp%252Fpwn&=id' Reverse Shell...

CVE-2026-87902

CVE-2026-87902 | ---|--- Advisory| GHSA-7hp8-65ch-5whp Product| WordPress = 7.1.1, fixed in 7.1.2; both versions tested Sink| wp-includes/template.php, getpagetemplate Cause| the candidate built from pagename is not passed through validatefile Actor| anonymous, no account, no cookie, no CSRF toke...

CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Validation Lab Security-research material for reproducing and validating CVE-2026-87902 GHSA-7hp8-65ch-5whp in an isolated, loopback-only Docker lab: an unauthenticated local file inclusion in WordPress core page-template resolution,...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

Exploit for PHP Remote File Inclusion in Wordpress

markdown 🎯 CVE-2026-87902 — WordPress Core LFI → RCE...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core Unauthenticated Local File Inc...

Exploit for CVE-2026-87902

cve-2026-87902 CVE-2026-87902 – WordPress Core LFI to RCE E...

Exploit for CVE-2026-87902

CVE-2026-87902 — Conditional LFI WordPress Core +/tmp/pwn.php...

Exploit for CVE-2026-87902

CVE‑2026‑87902 – WordPress Unauth LFI→RCE...

Exploit for CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Vali...

Exploit for CVE-2026-87902

CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress getpagetem...

Exploit for CVE-2026-87902

CVE-2026-87902 — Unauthenticated local file inclusion in WordP...

Exploit for CVE-2026-87902

CVE-2026-87902 — WordPress Core: unauthenticated path traversa...

Exploit for CVE-2026-87902

abraxaslabs.tech · github.com/abraxas ·&...

PT-2026-96839

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7.0 through 7.1.1 Description An unauthenticated path traversal flaw exists in the page-template resolution logic of the get page template function. The issue occurs because the pagename parameter is decoded late in the...

EUVD-2020-16872

Malware in sbrugna...

CVE-2020-24136

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...

CVE-2024-44819

Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the admin/del.php component...

PT-2024-31266 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS versions 2023 and earlier Description: A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the "admin/del.php" component. This flaw enables the attacker...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS from the ZZCMS team in China. A security vulnerability exists in ZZCMS v.2023 and earlier versions. A remote attacker can exploit this vulnerability to obtain sensitive information via a specially crafted script to the pagename parameter of the admin/del.p...