WordPress CVE-2026-87902: an Unauthenticated Path Traversal That Escalates into Remote Code Execution

A critical WordPress core traversal reachable without credentials, and the PEAR helper step that turns file inclusion into code execution.