WordPress Core Path Traversal Conditional Remote Code Execution Webapp Exploit (CVE-2026-87902)

This module exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.