CVE-2026-87902VulnerabilityPublished 10/01/2026

WordPress 7.0.2 - Path Travesal

Affects WordPress CoreSource Exploit-DB RSS Feed

Authoritative record:CVE-2026-87902· High 8.1

Exploited in the wild · KEV due 28 Sep 2026 · public exploit available (Exploit-DB) · 39% EPSS : apply the vendor's fix or mitigations to WordPress Core now.

Data as of 10/25/2026, 08:54:51 UTC

CVSS base score

8.1High

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Actively exploited – in CISA KEV since 09/25/2026
KEV deadline: 09/28/2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 39.9% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Public exploits: 1 Exploit-DB entry, a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.

Exploitation evidence

Disclosed: evidence found.
Public CVE; its cve.org publication date is not in this record
Detectable: evidence found.
nuclei template: WordPress Core - PHP Template Path Traversal
Weaponised: evidence found.
Public exploit code: Exploit-DB ×1, first 1 Oct 2026
Exploited in the wild: evidence found.
In CISA KEV since 25 Sep 2026
Observed by OffSeq Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV, the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE.

Deltas count from t = 0. Day-only sources (CISA KEV, Exploit-DB) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected software

Product	Affected	Fixed in
WordPress Core	Affected <7.1.2 =7.0.6	Fixed in 7.1.2

Public exploits and detection

Exploit-DB

WordPress 7.0.2 - Path Travesal2026-10-01 (opens in a new tab)

Nuclei detection templates

WordPress Core - PHP Template Path Traversalcritical (opens in a new tab)

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

Description

A path traversal vulnerability affects WordPress version 7.0.2 and version 7.0.6, as well as versions prior to 7.1.2. This vulnerability could allow an attacker to access files outside the intended directory structure.

Impact

Successful exploitation of this vulnerability could allow unauthorized access to sensitive files on the server hosting the affected WordPress installations. This could lead to information disclosure or further attacks depending on the files accessed.

Mitigation

Restrict access to sensitive directories and monitor for suspicious activity related to file access.

Summary

The reported security issue is a path traversal vulnerability in WordPress versions 7.0.2, 7.0.6, and all versions prior to 7.1.2. Path traversal vulnerabilities enable attackers to manipulate file paths to access unauthorized files on the server. No detailed technical information or exploit code is provided in the source data.

Weaknesses

CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (opens in a new tab)
Variant weaknessLikelihood of exploit: HighOWASP Top 10 A05:2025: Injection (opens in a new tab)
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Vulnerable Dependency Management (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.3 (opens in a new tab)
V12.3.6 (opens in a new tab)
V14.2.3 (opens in a new tab)
Attack patterns
PHP Remote File Inclusion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

Indicators of compromise

Exploit source code

Exploit code for WordPress 7.0.2 - Path Travesal11,827 characters

# Exploit Title: WordPress 7.0.2 - Path Travesal 
# Google Dork: N/A
# Date: 2026-09-22
# Exploit Author: Robert Ressl (https://ressl.ch)
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/download/releases/
# Version: WordPress 7.0.2 (patched in 7.1.2 and 7.0.6; backports to every =
branch down to 4.7.37)
# Tested on: WordPress 7.0.2 / PHP 8.3.33 (Apache module) / MySQL 8.4 (offi=
cial wordpress:7.0.2-php8.3-apache image, x86-64 and arm64)
# CVE: CVE-2026-87902
# Ad…

References

Community reviews

Loading reviews…