Preliminary research

CVE-2026-87902: WordPress file inclusion and conditional code execution

Robert Ressl · Robert Ressl · 22 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Anonymous page queries preserve encoded traversal until template resolution, where late decoding allows local PHP inclusion outside theme roots. The demonstrated PEAR execution chain requires a suitable page-prefixed theme directory, readable PEAR files, web-runtime argv support and a writable destination; execution remains at PHP account privilege.

Record

Researcher

Robert Ressl

Published by

Robert Ressl

Date

22 September 2026

Format

Advisory

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Research code and laboratory
• Vendor advisory

Tags

• wordpress
• path-traversal
• lfi
• php
• encoding
• rce
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Robert Ressl, first published at the original source. Preserved copies are kept so the citation survives its host.