CVE-2026-87902

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7.0 through 7.1.1

Description An unauthenticated path traversal flaw exists in the page-template resolution logic of the get page template() function. The issue occurs because the pagename parameter is decoded late in the process, allowing double-encoded dot-dot segments to bypass sanitization and escape the active theme directory. This enables an attacker to include any readable local .php file outside the theme directories.

Remote Code Execution (RCE) is possible if specific conditions are met: the active theme must have a top-level directory starting with page- (e.g., page-templates), and a readable PHP file must exist on the server that can be used as a payload. A common vector involves the pearcmd.php file when the register argc argv setting is enabled, a configuration found in official PHP Docker images and default cPanel setups for PHP versions prior to 8.5.

Real-world exploitation began within hours of disclosure. Attackers have been observed using a two-stage chain: first, using pearcmd.php via the config-create command to write a malicious PHP file to writable directories like /tmp or /var/tmp, and second, including that file to execute arbitrary shell commands.

Recommendations Update WordPress to version 7.1.2, 7.0.6, 6.9.9, 6.8.10, or the latest security backport for versions as old as 4.7.37. Disable the register argc argv setting in php.ini to neutralize the RCE vector involving pearcmd.php. Configure web application firewalls or reverse proxies to block encoded directory traversal sequences (e.g., %2e%2e) within the pagename parameter. Restrict PHP execution in uploads and log folders to minimize the risk of executing uploaded malicious files.