A critical unauthenticated vulnerability has been disclosed in WordPress affecting versions 4.7 through 7.1.1. According to the WordPress security advisory, the flaw exists in the get_page_template() function’s page-template resolution logic, which can be exploited to include a chosen readable PHP file from outside the active theme directories.
The vulnerability requires an attacker to be unauthenticated, meaning it can be exploited without any login credentials. However, the path traversal can lead to remote code execution only if specific pre-conditions are met on both the server environment and the active theme.
According to the advisory, the pre-conditions for RCE include: the target PHP file must exist on the server and be readable by the web server account. The advisory notes that a well-known PEAR-to-RCE transition via pearcmd.php can be leveraged when register_argc_argv is enabled. The official PHP Docker image and default cPanel configurations are specifically identified as affected when running PHP versions prior to 8.5.
The vulnerability affects multiple popular themes. According to the disclosure, legacy Twenty Twelve and Twenty Fourteen themes are vulnerable, along with third-party themes including Neve, Hestia, and Sydney.
WordPress 7.1.2 has been released to address the vulnerability. As a courtesy to users on older versions, the fix has been backported to all supported branches dating back to version 4.7. Patched versions are now available across the entire version history, including specific updates for versions 7.0.6, 6.9.9, 6.8.10, and all earlier maintained branches.
The vulnerability was discovered and responsibly disclosed by Robert Ressl. Site administrators are advised to update WordPress to the latest patched version available for their current branch to mitigate potential exploitation.
Key facts
- Unauthenticated path traversal vulnerability in WordPress page-template resolution
- Affects versions 4.7 through 7.1.1 across multiple release branches
- Can conditionally lead to remote code execution if specific server and theme conditions are present
- Patches released for all supported versions from 4.7 to 7.1.2
- Affects themes including Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney