{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-7A43EDF2",
  "slug": "cve-2026-87902-wordpress-core-page-template-lfi-kev",
  "title": "WordPress page template include hits CISA KEV",
  "aliases": [
    "CVE-2026-87902",
    "GHSA-7hp8-65ch-5whp",
    "WordPress Core Remote File Inclusion Vulnerability"
  ],
  "summary": "CISA added CVE-2026-87902 to KEV on 2026-09-25 (due 2026-09-28, forensic triage Yes). WordPress Core unauthenticated path traversal in get_page_template() can include a chosen readable local .php outside active theme dirs (CWE-98). Conditional RCE when the theme has a page-* top-level directory and a readable target such as pearcmd.php with register_argc_argv On. Fixed in 7.1.2 with backports through 4.7.37. Patchstack reports probing hours after the patch and pearcmd write-to-disk attempts.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Not every install is instantly RCE: needs theme page-* precondition plus a readable attacker-chosen .php. Known ransomware campaign use is Unknown. Exact in-the-wild payload variety beyond Patchstack's pearcmd stages is not fully enumerated here.",
  "firstObservedAt": "2026-09-22T13:57:27.000Z",
  "lastObservedAt": "2026-09-25T20:22:21.010Z",
  "publishedAt": "2026-09-25T20:45:43.980Z",
  "reviewedAt": "2026-09-25T20:43:58.142Z",
  "expiresAt": "2026-09-25T20:22:21.010Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ghsa",
      "label": "GHSA-7hp8-65ch-5whp WordPress Core",
      "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T13:57:27.000Z"
    },
    {
      "id": "wp-712",
      "label": "WordPress 7.1.2 release",
      "url": "https://wordpress.org/news/2026/09/wordpress-7-1-2-release/",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-09-22T00:00:00.000Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA Known Exploited Vulnerabilities catalog",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-09-25T00:00:00.000Z"
    },
    {
      "id": "patchstack",
      "label": "Patchstack probing and pearcmd exploitation write-up",
      "url": "https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/",
      "sourceType": "research",
      "observedAt": "2026-09-22T00:00:00.000Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-87902-wordpress-core-page-template-lfi-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-09-25T20:22:21.010Z"
    }
  ],
  "artifacts": [
    {
      "id": "wordpress-core",
      "artifactClass": "package",
      "ecosystem": "wordpress",
      "name": "WordPress Core",
      "version": ">=4.7.0 <7.1.2 (branch patches apply)",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "ghsa-publish",
      "occurredAt": "2026-09-22T13:57:27.000Z",
      "eventType": "disclosure",
      "summary": "WordPress published GHSA-7hp8-65ch-5whp / CVE-2026-87902 and released 7.1.2 with backports to 4.7.",
      "sourceIds": [
        "ghsa",
        "wp-712"
      ]
    },
    {
      "id": "patchstack-exploit",
      "occurredAt": "2026-09-22T11:49:00.000Z",
      "eventType": "first_observed",
      "summary": "Patchstack observed first probing activity; later update documents pearcmd.php include and write-to-disk stages.",
      "sourceIds": [
        "patchstack"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-09-25T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "CISA added CVE-2026-87902 to KEV (dateAdded 2026-09-25, dueDate 2026-09-28, forensicTriage Yes).",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-09-25T20:22:21.010Z",
      "eventType": "other",
      "summary": "HOL Guard published operator blog coverage for the same-day WordPress Core KEV.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "WordPress.com and hosts already on fixed builds are not the patch ticket.",
    "Themes without a top-level page-* directory are outside the GHSA LFI-to-RCE precondition path; still upgrade core.",
    "This is not unauthenticated RCE on every default install with zero preconditions.",
    "Distinct from CVE-2026-93485 WordPress comment XSS / 7.1.1."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-87902-wordpress-core-page-template-lfi-kev/corrections"
}