{"type":"bundle","id":"bundle--8b69886e-803d-5505-a09c-85e5b699ffa7","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--d0c1dcc2-05ba-5a74-9e74-7b3def713662","created":"2026-09-25T20:45:43.980Z","modified":"2026-09-25T20:45:43.980Z","name":"WordPress page template include hits CISA KEV","description":"CISA added CVE-2026-87902 to KEV on 2026-09-25 (due 2026-09-28, forensic triage Yes). WordPress Core unauthenticated path traversal in get_page_template() can include a chosen readable local .php outside active theme dirs (CWE-98). Conditional RCE when the theme has a page-* top-level directory and a readable target such as pearcmd.php with register_argc_argv On. Fixed in 7.1.2 with backports through 4.7.37. Patchstack reports probing hours after the patch and pearcmd write-to-disk attempts.","aliases":["CVE-2026-87902","GHSA-7hp8-65ch-5whp","WordPress Core Remote File Inclusion Vulnerability"],"first_seen":"2026-09-22T13:57:27.000Z","last_seen":"2026-09-25T20:22:21.010Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GHSA-7hp8-65ch-5whp WordPress Core","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"},{"source_name":"WordPress 7.1.2 release","url":"https://wordpress.org/news/2026/09/wordpress-7-1-2-release/"},{"source_name":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"Patchstack probing and pearcmd exploitation write-up","url":"https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-87902-wordpress-core-page-template-lfi-kev"}]}]}