CVE-2026-87902 WordPress Page-Template LFI

Overview

This workflow takes a list of site URLs and tells you which of them advertise a WordPress version inside the CVE-2026-87902 range. The affected window starts at 4.7.0 and runs through 7.1.1. The fix line starts at 7.1.2, with backports on the 7.0, 6.9, 6.8, 6.7, and 4.8 branches. Detect reads the public version fingerprint with GET requests: the generator meta tag, a core asset query string, or the feed generator. It does not send a path-traversal request and it does not include a file. A second node then records that the remaining host-side conditions were not verified from outside. Point the list at scope you are authorised to test and treat an affected version as the ticket for exposure management.

Run it again after core updates. A site that was in range before 7.1.2 should come back patched once that release, or its branch backport, is in place.

Pipeline

1. targets reads a file of site URLs, or writes https://wordpress.example.com when none is attached.
2. detect GETs each site and reads the WordPress version. Each row is classified against the fixed releases.
3. poc runs after detect. On an affected row it records the extra host-side conditions as unverified. It does not send a traversal request.
4. summary writes counts by status and the affected subset.

Inputs

• Target file. Site URLs, one per line, or JSONL with url or host. If no file is attached, the default is https://wordpress.example.com.

Outputs

• wordpress_findings.jsonl. One detect row per URL: target, version, version source, and status.
• cve_2026_87902_poc.jsonl. The detect row plus whether the extra host-side conditions were left unverified.
• summary.jsonl. One object: targets checked, status counts, and the affected subset.

Integrations

• HTTP. Unauthenticated GET for the version fingerprint. The follow-up node does not add a traversal request.

Sample output

The records below are an illustrative fixture for the default host, not a live result. They show a site with no WordPress version fingerprint, so the follow-up node does not run.

detect

poc

summary

{"cve": "CVE-2026-87902", "product": "WordPress Core", "affected_range": "4.7.0 - 7.1.1", "fixed_in": "7.1.2", "targets_checked": 1, "status_counts": {"VERSION_UNKNOWN": 1}, "poc_result_counts": {"skipped_not_affected": 1}, "affected_targets": []}

FAQ

Which versions does this flag as affected?

4.7.0 through 7.1.1, unless the branch already has its backport. 7.1.2 is the current-branch fix. Backports include 7.0.6, 6.9.9, 6.8.10, 6.7.9, and 4.8.32. A site with no readable version comes back VERSION_UNKNOWN, not affected.

Does an affected row mean a file was included?

No. Affected is a version comparison. The second node does not send a path-traversal request and does not include a file. It marks the remaining host-side conditions unverified.

When does the follow-up node run?

It runs after detect. A row that is not affected is recorded as skipped. An affected row is kept for review with those host-side conditions still unverified.

Is this check safe on production?

The version read is a GET of public pages. The follow-up does not send a traversal request. Run it only against scope you are authorised to test.

Related workflows

• WordPress Pre-Auth RCE (CVE-2026-63030). Reach for this when the question is that WordPress injection check rather than the page-template version floor.
• WordPress Vulnerability Scanner. Reach for this when you want a broader WordPress plugin and core pass rather than this one advisory.