WordPress 7.1.1 page-template path traversal

WordPress 7.1.1 does not check page-template paths correctly before including them, so an unauthenticated visitor can reach files outside the themes folder. The playbook installs 7.1.1 from the official release tarball on a stock Apache, PHP and MariaDB stack with the default theme and no hardening plugin, then starts the site. This is a core bug, not a misconfiguration. Good for practising config review and patch checks.

Web server path bugs are common in real audits. This target is useful for practicing config review and patch checks.

Product

WordPress

Version

7.1.1

Type

Traversal

Severity

High

Port

80/tcp

This playbook needs the setup from the earlier steps. Check these first.

• The base VM from Step 01 is built and reachable over SSH.
• You cloned the playbooks repo and set inventory/hosts.ini in Step 02.
• A snapshot named clean-base exists, and the machine is booted from it.

One CVE at a time. Don't run this on top of another playbook. Reset first.

Boot the machine from clean-base, then run the playbook for CVE-2026-87902. It installs WordPress 7.1.1, sets up its config and starts the service.

ansible-playbook cve/cve-2026-87902.yml 

A clean run ends with a recap that shows failed=0. If it fails partway, run it again.

The verify tag checks that the service is listening and running the version this CVE affects. Run it from the host.

ansible-playbook cve/cve-2026-87902.yml  --tags verify

You should see target OK.

- Requests with traversal sequences in page-template parameters - PHP warnings about files included from outside the theme directory - Web server reading files such as wp-config.php outside normal WordPress paths - The version string 7.1.1 in wp-includes/version.php

Fixed in WordPress 7.1.2, and backported to older branches down to 4.7.37. Update WordPress core and enable automatic security updates.

Restore clean-base. Nothing from this playbook carries over.

VBoxManage controlvm thehackingmachine acpipowerbutton
VBoxManage snapshot thehackingmachine restore clean-base
VBoxManage startvm thehackingmachine

• https://nvd.nist.gov/vuln/detail/CVE-2026-87902
• https://senserva.com/cve/CVE-2026-87902.html

Playbook and write-up by TheHackingMachine Team.

Want to add your own? See how to contribute.