Security Alert: WordPress Unauthenticated Path Traversal leading to Conditional RCE

A critical security vulnerability has been identified in WordPress involving unauthenticated path traversal during the resolution of page templates. This flaw can potentially be leveraged to achieve Remote Code Execution (RCE), provided specific environmental and configuration conditions are met.

🔍 Vulnerability Overview

The core of the issue lies within the get_page_template() function. An attacker who is not authenticated can manipulate this process to force the system to include a local .php file located outside of the designated active theme directories.

Attack Vector Flow

---

⚠️ Conditions for RCE

This vulnerability is "conditional," meaning RCE is not guaranteed on every installation. For a successful exploit leading to code execution, the following criteria must be satisfied:

1. Theme Structure Requirements

The active parent or child theme must contain a top-level directory that begins with the prefix page- (for example, a folder named page-templates/).

Known affected themes include:

• Twenty Eleven (Not listed) $\rightarrow$ Twenty Twelve
• Twenty Fourteen
• Neve
• Hestia
• Sydney

2. File Availability

There must be a target .php file residing on the server that is readable by the account running the web server.

3. Server Environment (The PEAR Path)

A common exploitation route involves the pearcmd.php file. The transition from PEAR $\rightarrow$ RCE is possible if the following PHP configuration is active: register_argc_argv = On

Note on Affected Environments:

• The official Docker PHP image is vulnerable.
• Default cPanel configurations are vulnerable when utilizing PHP versions older than 8.5.

---

🛠️ Version Impact & Remediation

The vulnerability spans a vast range of WordPress versions. The fix has been released in version 7.1.2 and backported to legacy branches as a courtesy.

Version Mapping Table

---

📊 Severity Analysis

The overall severity is rated as Critical.

$\text{CVSS v4 Base Score} = 9.2$

Detailed Metrics Breakdown

Exploitability

• Attack Vector: Network (Remote exploitation possible)
• Attack Complexity: Low (No significant evasion required)
• Attack Requirements: Present (Requires specific theme/server config)
• Privileges Required: None (Unauthenticated)
• User Interaction: None (No victim action needed)

Impact

• Confidentiality: High (Unauthorized access to sensitive data)
• Integrity: High (Unauthorized modification of system data)
• Availability: High (Potential for total system disruption)

Metric Definitions

• Attack Vector: Measures how remote the attacker can be. Network-based attacks are more severe than physical ones.
• Attack Complexity: Measures the effort to bypass security controls. Low complexity means the exploit is more reliable.
• Attack Requirements: Prerequisites of the deployment (e.g., specific software versions) that enable the attack.
• Privileges Required: The level of access an attacker needs before starting. In this case, none.
• User Interaction: Whether a legitimate user must perform an action for the attack to work.
• Confidentiality/Integrity/Availability: The "CIA triad" measuring the damage to data privacy, data accuracy, and system uptime.