CVE-2026-87902: WordPress core pagename template path traversal

HoneyLabs honeypots recorded 717 probes matching CVE-2026-87902 from 2 distinct source IP addresses in the last 7 days, of which 717 on interactive sensors. Severity is rated high.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2026-09-25.

2 sources probed for CVE-2026-87902 on the interactive sensors. None of them sent the exploit payload.

What the sensors show

Probes arrived on 3 of the 7 days in this window. The busiest day was 2026-11-01, with 504. One address, 103.134.154.120, sent 94% of them. The largest source network was AS138608 (Cloud Host Pte Ltd), with 94% of the probes from 1 address. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i1711h1_ab0a1bf427ad_882d495ac381.

Request paths that identify it

• /?{{*}}pagename=templates/%252E%252E
• /?{{*}}pagename=templates%252F%252E%252E

Addresses probing it

Networks it comes from

Where it comes from

Requests the interactive sensors answered

• GET /?page_id=1&pagename=templates%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwp-links-opml
• GET /?page_id=1&pagename=templates%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwp-links-opml
• GET /?page_id=1&pagename=templates%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwp-links-opml
• GET /?page_id=1&pagename=templates%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwp-links-opml

HTTP client fingerprints

• b11cun050_00040017_38043d51
• b11cuq060_00040817_229ec904
• b11cun060_0004001f_27db4736