WordPress patch addresses unauthenticated path traversal vulnerability leading to potential RCE

The identified vulnerability in WordPress allows unauthenticated attackers to exploit the page-template resolution mechanism. Specifically, it lets attackers include a readable PHP file from outside the active theme directories, which can lead to remote code execution (RCE) under certain pre-conditions.

This issue affects various versions of WordPress, specifically from 4.7 to 7.1.1, and can compromise systems using specific themes that contain top-level directories starting with 'page-'. Users running affected versions should prioritize updating to the patched 7.1.2 version or the corresponding updates in older branches.

The vulnerability's exploitation requires no user interaction and low attack complexity, making it accessible to a wider range of potential attackers. This means that any server with the right configuration and vulnerable themes is at risk, particularly those using PHP versions prior to 8.5.

Notably, the presence of the well-known pearcmd.php file can be exploited if certain PHP settings are enabled, further emphasizing the need for careful server configuration. All WordPress users must review their themes and ensure they are on a supported version to avoid potential exploitation.

Finally, the responsible disclosure by the researcher highlights the importance of community vigilance in security matters. Users should remain proactive about security updates and regularly audit their configurations to safeguard against similar vulnerabilities in the future.