WordPress - LFI

1name: crowdsecurity/vpatch-CVE-2026-87902
2description: 'Detects WordPress core path traversal in page template resolution (CVE-2026-87902)'
3rules:1
4  # WP sanitizes 'pagename' with sanitize_title_for_query() before get_page_template()
5  # urldecodes it, so only percent-encoded dots and slashes can reach the traversal.
6  # Literal '../' never survives; anything outside [%a-z0-9 _-] is dropped, so the
7  # encoded octets may be split by characters WordPress strips.
8  - zones:2
9      - ARGS
10      - BODY_ARGS
11    variables:1
12      - pagename
13    transform:3
14      - lowercase
15    match:4
16      type: regex
17      value: '%2e[^%a-z0-9 _.-]*%2e[^%a-z0-9 _.-]*%2f'
18
19labels:5
20  type: exploit
21  service: http
22  confidence: 3
23  spoofable: 0
24  behavior: 'http:exploit'
25  label: 'WordPress - LFI'
26  classification:
27    - cve.CVE-2026-87902
28    - attack.T1190
29    - cwe.CWE-98