WordPress Core CVE-2026-87902 Page Template LFI Detect

Detects CVE-2026-87902 in WordPress Core 4.7.0 through 7.1.1: getpagetemplate decodes pagename without validatefile, enabling unauthenticated local .php inclusion when the active theme exposes a top-level page- directory e.g. page-templates/. Fixed in 7.1.2. !/usr/bin/env python3 -- coding: utf-8...

WordPress Core CVE-2026-87902 Page Template LFI/RCE

Exploits CVE-2026-87902 when the active theme contains a page- directory and pearcmd.php is readable with registerargcargv enabled. Stage 1 uses double-encoded pagename traversal to include pearcmd and write a webroot marker; stage 2 executes verifycmd through the dropped PHP file. !/usr/bin/env...

WordPress wp2shell RCE (CVE-2026-63030 + CVE-2026-60137)

Exploits CVE-2026-63030 REST batch route confusion chained with CVE-2026-60137 WPQuery authornotin SQLi on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1: unauthenticated administrator creation, plugin upload, and command execution. Patched in 6.9.5 and 7.0.2. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...