Exploit Title: WordPress 7.0.2 - Path Travesal Google Dork: N/A Date: 2026-09-22 Exploit Author: Robert Ressl (https://ressl.ch) Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download/releases/ Version: WordPress 7.0.2 (patched in 7.1.2 and 7.0.6; backports to every = branch down to 4.7.37) Tested on: WordPress 7.0.2 / PHP 8.3.33 (Apache module) / MySQL 8.4 (offi= cial wordpress:7.0.2-php8.3-apache image, x86-64 and arm64) CVE: CVE-2026-87902 Advisory: https://github.com/WordPress/wordpress-develop/security/advisor= ies/GHSA-7hp8-65ch-5whp Write-up: https://ressl.ch/blog/cve-2026-87902-wordpress/ Source: https://github.com/ressl/cve-2026-87902-poc Requires: Python 3.6+ (standard library only) Usage: python3 cve-2026-87902.py --url http://127.0.0.1:8091…