An unauthenticated attacker can exploit a path traversal vulnerability in WordPress's get_page_template() function to include a chosen readable local .php file outside active theme directories. Under specific pre-conditions, this can lead to remote code execution (RCE). The vulnerability requires the active child or parent theme to contain a top-level directory starting with page-, such as page-templates.

Affected themes include legacy Twenty Twelve and Twenty Fourteen, as well as popular third party themes like Neve, Hestia, and Sydney. A chosen local .php target file must also exist on the server and be readable by the web server account. The well known pearcmd.php PEAR→RCE transition can be leveraged when register_argc_argv is set to On.

The official php image for Docker is affected, and the default c Panel configuration is affected when PHP prior to 8.5 is in use. WordPress 7.1.2 has been released containing a fix, and the fix has been backported to all branches back to 4.7. The vulnerability was discovered and responsibly disclosed by Robert Ressl.