Unauthenticated WordPress LFI-to-RCE: double-encode the pagename param, abuse pearcmd.php, own the box. https://intel.threadlinqs.com/threat/TL-2026-2623 #ThreatIntel #CVE_2026_87902 #pear #PHP

Unauthenticated WordPress LFI-to-RCE: double-encode the pagename param, abuse pearcmd.php, own the box. https://intel.threadlinqs.com/threat/TL-2026-2623 #ThreatIntel #CVE_2026_87902 #pear #PHP