WordPress has patched an unauthenticated path traversal vulnerability in its page-template resolution logic — the function getpagetemplate() — that allows an attacker to force inclusion of arbitrary local .php files outside the active theme directory. Under specific but common preconditions, this chains directly to remote code execution. No login required. The preconditions are narrower than a blanket RCE but wider than defenders would like. First, the active child or parent theme must contain a top-level directory whose name begins with "page-" (e.g., page-templates). This is not exotic. The legacy Twenty Twelve and Twenty Fourteen default themes ship with exactly this structure, as do popular third-party themes including Neve, Hestia, and Sydney. Second, a suitable .php file must exist and be readable on the server — the well-known pearcmd.php PEAR-to-RCE transition works when registerargcargv is set to On. The official PHP Docker image is affected. The default cPanel configuration is affected when running PHP prior to 8.5. The intersection of these preconditions covers a meaningful slice of the WordPress install base. Docker-based WordPress deployments, shared hosting on cPanel with older PHP, and sites running any of the named themes all sit in the blast radius. The fix shipped in WordPress 7.1.2 and has been backported to every supported branch down to 4.7 — a courtesy that underscores how seriously the WordPress security team views the issue. Credit goes to researcher Robert Ressl, who discovered the vulnerability and disclosed it responsibly. The coordinated disclosure gave WordPress time to ship patches across its entire branch history before public details dropped. That process worked as intended. The deeper structural issue is WordPress's template-resolution architecture itself. The getpagetemplate() function was never designed to be a security boundary, yet it effectively operates as one — deciding which .php files get included based on theme directory contents. When directory-naming conventions leak into file-inclusion logic, path traversal becomes an architectural class of bug, not just a one-off coding error. For defenders, the immediate action is straightforward: update. But the longer tail involves auditing theme directory structures and server configurations. Sites running the official PHP Docker image or cPanel with pre-8.5 PHP should treat this as urgent. The pearcmd.php attack vector is well-documented and weaponized in the wild. The WordPress ecosystem's auto-update infrastructure will protect many sites, but the long tail of unmaintained installations — especially in Docker containers and legacy shared hosting — remains exposed. This is a pattern: WordPress's scale is simultaneously its greatest resilience asset and its greatest fragility vector.
