Unauthenticated path traversal in page-template resolution leading to conditional RCE

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE.

The pre-conditions are:

• The active child or parent theme contains a top-level directory whose name starts with page- (e.g. page-templates). This affects the legacy Twenty Twelve and Twenty Fourteen themes, as well as some popular third party themes such as Neve, Hestia, and Sydney.
• A chosen local .php target file exists on the server and is readable by the web server account. The well known pearcmd.php PEAR→RCE transition can be used for this when register_argc_argv is set to On. The official php image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use.

WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Discovered and responsibly disclosed by Robert Ressl.