WordPress patches path traversal flaw that can lead to RCE
WordPress core has published a security advisory for an unauthenticated path traversal vulnerability in its page-template resolution logic. The function get_page_template() can be made to include a chosen, readable local .php file from outside the active theme's own directories, without any login required. On its own this is a file-inclusion bug; under the right conditions it becomes remote code execution.
Two separate preconditions have to line up. First, the active parent or child theme must contain a top-level directory whose name starts with "page-" (for example page-templates). The advisory names the legacy Twenty Twelve and Twenty Fourteen default themes as affected, along with popular third-party themes Neve, Hestia and Sydney. Second, a suitable local .php file has to already exist on the server and be readable by the web server's account. The advisory points to the well-known pearcmd.php file, which offers a documented path from PEAR to code execution, as usable for this step when the PHP setting register_argc_argv is turned on. That combination is present in the official PHP Docker image, and in a default cPanel setup running a PHP version older than 8.5.
The bug reaches back a long way: every version line from 4.7.0 up through the current 7.1.0-7.1.1 branch is affected. WordPress 7.1.2 ships the fix, and the project backported it to every branch going back to 4.7, releasing a patched point version for each one. The vulnerability was discovered and responsibly disclosed by Robert Ressl.
Key facts
- An unauthenticated attacker can make get_page_template() include a chosen readable local .php file from outside the active theme's directories.
- Exploitation requires the active theme to have a top-level directory whose name starts with "page-", which affects Twenty Twelve, Twenty Fourteen, and third-party themes Neve, Hestia and Sydney.
- Escalating to RCE also requires a readable local .php file such as pearcmd.php with register_argc_argv set to On, a combination present in the official PHP Docker image and in default cPanel setups running PHP older than 8.5.
- Every version from 4.7.0 through the newest 7.1.0-7.1.1 branch is affected; the fix shipped in WordPress 7.1.2 and was backported as a patched release on every branch back to 4.7.
- The flaw was discovered and responsibly disclosed by Robert Ressl.
Why it matters
Unauthenticated path traversal in a core WordPress function, not a plugin, is a serious class of bug on its own, and this one carries a documented route to remote code execution. WordPress runs a very large share of the web, so a flaw in core template resolution has a wide blast radius even though the RCE step needs extra conditions to fire.
Who it affects
Site owners running a theme with a top-level directory named starting with "page-" are exposed to the path traversal itself; the advisory names the legacy Twenty Twelve and Twenty Fourteen default themes plus the third-party themes Neve, Hestia and Sydney as fitting that pattern. Whether that traversal turns into full RCE additionally depends on the server: it needs a readable local .php file such as pearcmd.php with register_argc_argv enabled, which the advisory says is the case for the official PHP Docker image and for default cPanel installs on PHP versions before 8.5.
How to use it
The fix is WordPress 7.1.2, a normal core update. The project also backported the fix as a point release on every branch back to 4.7.0, so sites on older major versions can patch without a full upgrade. This is a core security fix with no separate licence or cost.
How solid is it
The source is WordPress's own official security advisory published on GitHub (GHSA-7hp8-65ch-5whp), giving a full technical description of the vulnerable function, both preconditions, the affected version ranges and the patched versions. The finder, Robert Ressl, is credited by name for responsible disclosure. The advisory does not state a CVE identifier or give dates for discovery, disclosure or the fix.
Risks and caveats
The path traversal itself needs no authentication, but reaching remote code execution is conditional on both a specific theme layout and a specific server configuration; not every WordPress install that has the vulnerable code path is exploitable to RCE. The advisory says nothing about exploitation having been observed in the wild, nor about how many live sites run an affected theme.