WordPress patches 9.2-rated path traversal with RCE risk in all releases since 2016

WordPress has shipped version 7.1.2 to close a vulnerability rated 9.2 out of 10 that has been present in every release of the platform since 2016. According to the security advisory published in the WordPress development repository on GitHub (GHSA-7hp8-65ch-5whp), which gained attention on the Hacker News front page, the flaw is an unauthenticated path traversal in page-template resolution that can be escalated into remote code execution on servers meeting certain common conditions.

How the flaw works

When WordPress renders a page, a function called get_page_template() selects which template file from the active theme to load. According to the advisory, an attacker who holds no account on the target site can manipulate this lookup so that WordPress pulls in a readable local .php file located outside the theme directories, the boundary that is supposed to constrain where templates can come from. On its own that makes the bug a serious file-inclusion issue; the advisory is careful to note that remote code execution follows only when additional conditions on both the server environment and the active theme are met.

The conditions for exploitation

The advisory lists two pre-conditions:

• The active child or parent theme contains a top-level directory whose name starts with page-, for example page-templates. This is not an exotic pattern: the legacy default themes Twenty Twelve and Twenty Fourteen are affected, as are popular third-party themes including Neve, Hestia and Sydney.
• A chosen local .php file exists on the server and is readable by the web server account. Here the advisory points to the well-known pearcmd.php route to code execution: pearcmd is a helper script from PHP's PEAR tooling that is often present on servers, and when the register_argc_argv setting is enabled, including it through the traversal allows an attacker to run commands. The official PHP image for Docker is affected, and default cPanel configurations are affected when running PHP versions prior to 8.5.

In practice, that means the required pieces can line up on widely used hosting configurations rather than only on mismanaged servers.

The fix and its reach

WordPress 7.1.2 has been released containing the fix. Because the vulnerable code has been in place for so long, the maintainers also backported the patch to every branch back to version 4.7, which dates the exposure to 2016 and explains why the advisory describes all versions since then as affected. The vulnerability was discovered and responsibly disclosed by Robert Ressl.

Why it matters

The flaw requires no authentication, so any exposed site was a candidate target rather than only those with compromised or weak accounts. Exploitation hinges on details most operators would never think to audit, such as a directory name inside their theme and a PHP setting inherited from a base image or a hosting control panel, so sites can be exposed without having done anything obviously wrong. The roughly decade-long lifetime of the bug is also a reminder that old template-resolution code paths can carry a critical rating for years without being noticed. The practical response for operators is to update to 7.1.2 or a patched older branch, and, as defence in depth, to check whether the active theme exposes a top-level page- directory and whether register_argc_argv can be turned off on the runtime.