Back to the CVE list
CVE-2026-87902 CISA KEV · Actively exploited

Vulnerability in WordPress

CVSS score

8.1

EPSS probability

%40.0

Risk score

6.5

Published

23 d ago

OverviewPublic Exploits (15)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
tc4dy/CVE-2026-87902-Toolkit
GitHub

CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. | 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). Use Ethically & Authorized Enviorement, Stay Legal <3

Public PoCSource updated: 15.10.2026 04:09:36
G
xiaxiu555/cve-2026-87902
GitHub

cve-2026-87902 lab

Public PoCSource updated: 07.10.2026 07:53:43
G
abraxas/CVE-2026-87902
GitHub

CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)

Public PoCSource updated: 07.10.2026 01:07:34
G
HackfutSecRoot/CVE-2026-87902
GitHub

CVE-2026-87902 — WordPress Core LFI → RCE by Hackfut

Public PoCSource updated: 04.10.2026 09:54:35
G
tonydelouvre/CVE-2026-87902
GitHub

XWP_RCE — CVE-2026-87902 Hacker Console

Public PoCSource updated: 10.10.2026 02:20:46
G
MRdark-ops/CVE-2026-87902
GitHub

CVE-2026-87902 — WordPress Core LFI → RCE

Public PoCSource updated: 28.09.2026 21:21:19
G
Maalfer/CVE-2026-87902-exploit
GitHub

Exploit para explotar la vulnerabilidad CVE-2026-87902 que se acontece en el core de WordPress

Public PoCSource updated: 01.10.2026 04:25:41
G
abatsakidis/wp-cve-2026-87902-checker
GitHub

Defensive WordPress security scanner for CVE-2026-87902 — local filesystem inspection and safe remote HTTP/HTTPS assessment.

Public PoCSource updated: 02.10.2026 03:51:30
G
langz337/CVE-2026-87902
GitHub

Unauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 – 7.1.1).

Public PoCSource updated: 27.09.2026 12:06:10
G
rwxrwxs/CVE-2026-87902
GitHub

CVE-2026-87902

Public PoCSource updated: 27.09.2026 05:07:23
E
WordPress 7.0.2 - Path Travesal
Exploit-DB

WordPress 7.0.2 - Path Travesal

Exploit referenceSource updated: 01.10.2026 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml
Nuclei

Nuclei: WordPress Core - PHP Template Path Traversal

Exploit reference
G
dinosn/cve-2026-87902-wordpress-lfi-lab
GitHub

Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.

Public PoCSource updated: 23.09.2026 05:20:08
G
ressl/cve-2026-87902-poc
GitHub

PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab

Public PoCSource updated: 22.09.2026 18:40:26
G
vulpecuna/CVE-2026-87902
GitHub

Unauthenticated RCE on Wordpress

Public PoCSource updated: 22.09.2026 18:32:56

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-87902"