WordPress: Unauthenticated path traversal leading to conditional RCE

8 relevance

WordPress RCE vulnerability with detailed advisory, directly actionable for patching.

Security github.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For engineers maintaining WordPress sites or developing on it, this unauthenticated, network-exploitable RCE path with low attack complexity demands immediate patching of any active instance to prevent complete server compromise.

Key Takeaways

Upgrade all WordPress installations to the latest patched version for your branch (e.g., 7.1.2, 6.9.9) and verify no themes contain a "page-" top-level directory if you cannot patch immediately.

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for ...

Summary

WordPress patched a critical (CVSS 9.2) unauthenticated path traversal in get_page_template() that enables conditional RCE via pearcmd.php, affecting all versions back to 4.7. The exploit requires themes like Neve or legacy Twenty Twelve with a "page-" top-level directory and server configurations like cPanel or Docker with PHP prior to 8.5. Robert Ressl disclosed the flaw, and fixes have been backported to every branch since 4.7.

Author

WordPress