WordPress: Unauthenticated path traversal leading to conditional RCE
WordPress users, check your themes: an unauthenticated path traversal vulnerability was discovered, leading to conditional Remote Code Execution (RCE). This flaw leverages common theme development practices and specific server configurations, affecting a wide range of installations. Hacker News debated the real-world impact and questioned the efficacy of standard security scoring for such nuanced exploits.
The Lowdown
A recently disclosed vulnerability in WordPress has revealed an unauthenticated path traversal flaw that, under specific conditions, can lead to Remote Code Execution (RCE). This issue stems from the get_page_template() function's inability to prevent directory traversal, allowing attackers to include chosen readable local .php files outside of the active theme directories.
- The vulnerability is triggered if the active theme (child or parent) contains a top-level directory starting with
page-(e.g.,page-templates). This affects popular themes like Neve, Hestia, Sydney, and older Twenty Twelve/Fourteen themes, as well as many custom themes following a common, and even officially recommended, WordPress convention. - For RCE, a specific
.phpfile must exist and be readable on the server. Thepearcmd.phpfile, whenregister_argc_argvisOn, is a common vector, with the officialphpDocker image and default cPanel configurations (PHP < 8.5) noted as vulnerable. - The fix has been released in WordPress 7.1.2 and backported to all branches as far back as 4.7.
- The flaw was responsibly disclosed by Robert Ressl and, ironically, a similar potential issue was noted in a WordPress documentation comment almost a decade ago.
This vulnerability highlights the challenges of maintaining security in widely adopted platforms, especially when common development practices can inadvertently open doors for sophisticated attacks under specific environmental conditions.
The Gossip
Severity & Scoring Scrutiny
Commenters fiercely debated the actual severity and prevalence of the RCE vulnerability. While some initially downplayed it as 'situational' and affecting 'only a couple themes,' others, including the article author, countered that the pre-conditions, particularly the 'page-' prefix in themes, are widely used and even officially recommended by WordPress, making many installations vulnerable. The discussion also extended to the utility and accuracy of CVSS scores in reflecting real-world impact, with some likening them to a 'Ouija Board' that can be interpreted subjectively.
Perennial Problems & Prescient Warnings
A striking point of discussion was the long-standing nature of the vulnerability. The article author highlighted a nine-year-old comment on WordPress's own documentation that perfectly described the nature and potential remediation of this exact flaw. This sparked conversation about WordPress's legacy code, the challenges of technical debt, and the recurring nature of certain security issues within the platform's ecosystem.
Exploitation's Entangling Elements
The technical specifics of the RCE's pre-conditions, such as the presence of `pearcmd.php` and the `register_argc_argv` setting, were scrutinized. While these conditions might not be universal across all hosting providers, commenters noted that the official PHP Docker image explicitly has this configuration, making containerized environments a particular concern. The possibility of chaining this path traversal with other WordPress plugin vulnerabilities, like unauthorized file uploads, to achieve RCE was also discussed.