WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

A critical vulnerability in WordPress allows an attacker without an account to load a PHP file from outside the theme folders, potentially leading to code execution on some servers. This flaw, assigned a CVSS score of 9.2, has been patched in version 7.1.2 and earlier, and WordPress is urging site owners to update immediately. The vulnerability stems from a flaw in how WordPress chooses template files, and requires a specific configuration on the server to be exploited.

WordPress rates the flaw as critical and has released version 7.1.2 to address it. The vulnerability occurs because WordPress builds a template file name from part of the web address, and older versions did not properly check for potential ../ traversal steps. To exploit this, the server must have a PHP file in a top-level folder whose name starts with ‘page-’, and the target file must end in .php.

Security vendor Patchstack notes that two factors indicate a site's exposure: whether the active theme has a top-level folder whose name begins with ‘page-’, and whether PHP is running with the ‘register_argc_argv’ setting turned on. Neither of these conditions is a fix, but they illustrate how close a site is to being vulnerable.

As of September 22, there were no reports of the flaw being used in attacks, no public proof-of-concept exploit, and no entry for it in the U.S. CISA Known Exploited Vulnerabilities catalog. Robert Ressl discovered and reported the flaw to WordPress.