CVE-2026-87902: WordPress Unauthenticated Path Traversal Leads to Critical Code Execution — Fedora 43 Detection and Remediation Guide

---
title: WordPress CVE-2026-87902 Path Traversal in Template Resolution Request
id: 3f8c1a42-7b9d-4e51-a6c2-9d4e5f6a7b8c
status: experimental
description: Detects HTTP requests containing directory traversal sequences targeting WordPress template-resolution parameters or URIs, consistent with exploitation of CVE-2026-87902 (unauthenticated path traversal in page-template resolution).
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-wordpress-2026-5c9d8e41a9
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e\\'
      - '%252e%252e'
      - '....//'
  selection_wp:
    cs-uri-query|contains:
      - 'template'
      - 'pagename'
      - 'page_id'
      - 'wp-content/themes'
  condition: selection_uri and selection_wp
falsepositives:
  - Legitimate theme/plugin developers testing template paths
  - Broken internal links with malformed relative paths
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter
id: 8a2d4e61-3c7b-4f92-b1d5-6e8a9c0d1e2f
status: experimental
description: Detects Apache, Nginx, or PHP-FPM worker processes spawning command shells or interpreters — a strong post-exploitation indicator following WordPress code execution such as CVE-2026-87902 template-include RCE.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-wordpress-2026-5c9d8e41a9
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate plugin functionality invoking system commands (e.g., image processing, backups) — investigate parent-child context before dismissing
level: critical
---
title: PHP File Written to WordPress Uploads Directory
id: c5e7f2a9-1d4b-48e6-93a1-2b3c4d5e6f70
status: experimental
description: Detects creation of PHP files inside wp-content/uploads — a canonical webshell drop location following WordPress RCE exploitation such as CVE-2026-87902. The uploads tree should never legitimately contain executable PHP.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-wordpress-2026-5c9d8e41a9
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection
falsepositives:
  - Extremely rare; some broken plugins write PHP into uploads — any hit warrants triage
level: critical

// Hunt 1: Traversal sequences in requests to WordPress template parameters (Apache/Nginx via Syslog ingestion)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("httpd", "apache2", "nginx", "php-fpm") or Computer has "web"
| extend RawMsg = tostring(SyslogMessage)
| where RawMsg has_any ("../", "%2e%2e", "%252e", "....//")
| where RawMsg has_any ("template", "pagename", "page_id", "wp-content/themes", "index.php")
| extend HttpRequest = extract(@"GET ([^ ]+)", 1, RawMsg)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Computer, SourceIP = HostIP, HttpRequest
| order by RequestCount desc
;
// Hunt 2: Web server process spawning shell/interpreter child processes (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("httpd", "apache2", "nginx", "php-fpm", "php-cgi")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python3", "perl", "nc", "ncat", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc
;
// Hunt 3: PHP files created under wp-content/uploads (webshell staging)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has "wp-content/uploads"
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

-- WordPress CVE-2026-87902 triage: PHP files in uploads + suspicious web-server child processes
-- Part 1: PHP/executable files planted under wp-content/uploads (webshell candidates)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php')
WHERE Mtime > now() - 1209600  -- last 14 days
ORDER BY Mtime DESC

-- Part 2: Web server processes with shell/interpreter children (live RCE indicator)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(/bin/(ba|da|z)?sh|curl|wget|python|perl|ncat|base64)'
   OR Name =~ '^(sh|bash|dash|nc|ncat)$'

-- Part 3: Recently modified files in theme directories (template overwrite persistence)
SELECT FullPath, Size, Mtime
FROM glob(globs='/var/www/**/wp-content/themes/**/*.php')
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

#!/usr/bin/env bash
# CVE-2026-87902 remediation & verification — Fedora 43 WordPress
# Run as root. Stops on error; prints verification evidence for change records.
set -euo pipefail

echo "=== [1/5] Current WordPress package version ==="
rpm -q wordpress || echo "wordpress package not installed via rpm — check manual installs under /var/www"

echo "=== [2/5] Applying Fedora 43 security update (FEDORA-2026-5c9d8e41a9) ==="
dnf -y upgrade wordpress --advisory=FEDORA-2026-5c9d8e41a9 || dnf -y upgrade wordpress

echo "=== [3/5] Verifying patched version (must be 6.9.9 or later) ==="
WP_VER=$(rpm -q --qf '%{VERSION}' wordpress 2>/dev/null || echo "0")
echo "Installed WordPress version: ${WP_VER}"
if [[ "$(printf '%s\n' "6.9.9" "${WP_VER}" | sort -V | head -n1)" != "6.9.9" ]]; then
  echo "[!] WARNING: WordPress version ${WP_VER} is BELOW 6.9.9 — still vulnerable to CVE-2026-87902"
fi
# For non-rpm installs, check version.php directly:
# grep -h '\$wp_version' /var/www/*/wp-includes/version.php

echo "=== [4/5] Hunting for webshell artifacts in uploads (should return empty) ==="
find /var/www -type d -path '*wp-content/uploads*' -exec find {} -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -14 -ls \; 2>/dev/null || true

echo "=== [5/5] Hunting logs for traversal probes against template parameters ==="
journalctl -u httpd -u nginx --since "14 days ago" 2>/dev/null | grep -Ei '(\.\./|%2e%2e|%252e|\.\.\.\.//).*(template|pagename|page_id)' | tail -50 || \
grep -Ehi '(\.\./|%2e%2e|%252e|\.\.\.\.//).*(template|pagename|page_id)' /var/log/httpd/*access*log /var/log/nginx/*access*log 2>/dev/null | tail -50 || echo "No matches — retain logs for IR timeline anyway"

echo "=== Hardening reminder: disable PHP execution in uploads ==="
cat <<'EOF'
# Add to your Apache config / .htaccess inside wp-content/uploads:
#   <FilesMatch "\.(php|phtml|phar)$">
#     Require all denied
#   </FilesMatch>
# For nginx, add a location block returning 403 for PHP under /wp-content/uploads/.
EOF