WordPress patches unauthenticated path traversal that can chain to RCE

A flaw in WordPress’s get_page_template() page-template resolution lets an unauthenticated attacker force the inclusion of an arbitrary readable local .php file from outside the active theme’s directories. On its own it’s a path traversal, but under the right conditions it escalates to remote code execution. The bug spans virtually every supported branch — patched versions were shipped for everything from 7.1.2 down to a backport to 4.7.37.

Exploitation is conditional, not universal. Two things have to line up: the active parent or child theme must contain a top-level directory whose name begins with page- (present in the bundled Twenty Twelve and Twenty Fourteen themes and popular third-party themes like Neve, Hestia, and Sydney), and a suitable attacker-chosen .php file must already exist and be readable by the web server. The classic route to the latter is pearcmd.php, whose PEAR-to-RCE trick works when register_argc_argv is enabled — a configuration that ships in the official PHP Docker image and in default cPanel setups running PHP before 8.5.

The practical takeaway is that a large share of real-world installs meet the preconditions, so this should be treated as urgent rather than theoretical. Admins on any branch should apply the released fix immediately; where patching lags, disabling register_argc_argv and removing stray PEAR tooling narrows the RCE path. The issue was responsibly disclosed by Robert Ressl.