WordPress: Unauthenticated path traversal leading to conditional RCE

Original Article ↗ Hacker News Discussion ↗

A newly disclosed WordPress vulnerability allows unauthenticated path traversal that can lead to remote code execution under certain configurations, notably when combined with common theme structures and insecure PHP setups such as the official Docker images. Commenters debate how widespread the risk really is, pointing out that many themes follow WordPress’s own directory recommendations and that core patches have now been backported to older versions. The incident reignites broader criticism of WordPress’s security model, plugin ecosystem, and reliance on CVSS base scores, with some arguing organizations should isolate or replace WordPress entirely, while others stress that careful configuration and hardening can keep it reasonably safe.

Vulnerability & impact

  • Core issue: unsanitized use of get_page_template / locate_template, allowing path traversal to include arbitrary PHP files already on the server.
  • Main precondition: theme has a top‑level page-* directory (e.g., page-templates/), which WordPress documentation explicitly recommends. Several commenters argue this makes a large number of themes vulnerable, not just “a couple.”
  • On a fresh install, random users cannot upload PHP, but attackers can abuse any existing “PHP that runs commands” on the system.

Conditions and exploit chains

  • Example chain: combine this flaw with one of many unauthenticated file‑upload bugs in plugins to reach conditional RCE; attackers may prefer this to simple webshell uploads to evade hardened configs and logging.
  • The official PHP Docker image historically shipped pearcmd.php with register_argc_argv enabled and no open_basedir, giving a powerful target once path traversal is achieved.
  • Some argue this is effectively “drive‑by exploitable” on sites using popular themes plus default Docker or shared hosting setups.

Patch status & deployment

  • Fixed in WordPress 7.1.2, with backports “as a courtesy” to branches back to 4.7 (except a broken auto‑update version).
  • One commenter initially wonders if themes still need auditing after patch, but concludes the core fix should neutralize the theme behavior.
  • WordPress does not do true LTS; older branches depend on selective backports, leaving unknown bugs unpatched.

CVSS scoring debate

  • One camp: CVSS scores are “Ouija board” numbers, easily manipulated and often misaligned with real‑world risk; using them to triage what to read is dangerous.
  • Other camp: base CVSS is a useful first‑pass measure of technical impact; organizations should re‑score per environment using calculators and compensating controls.
  • Example contrast: this WordPress RCE (9.x) vs Hugo tooling vulns (also 9.3) — same numeric severity but very different practical exposure.

Assessments of WordPress security

  • Strong criticism: “RCE‑as‑a‑Service,” “piece of garbage,” messy, poorly typed code, many undocumented APIs, insecure default model (site can write its own code; uploads often executable; plugins massively expand attack surface).
  • Counterpoints: extremely popular, including high‑value sites; can be run safely with expertise, hardening, and disciplined plugin use. Problems often stem from low‑cost contractors and non‑experts “lego‑mounting” plugins and themes.
  • Some argue popularity and extensibility inevitably draw attackers; others say popularity alone doesn’t explain WordPress’s exploit history.

Alternatives & migrations

  • Multiple participants report migrating from WordPress to static generators (Hugo, Astro) or mostly‑static custom PHP, describing:
    • Huge reduction in operational complexity and security worry.
    • Freedom from plugin cruft, black‑box behavior, and fragile upgrades.
  • However, even static tooling can have high‑CVSS bugs (Hugo example); the difference is that the generated sites are static HTML, so runtime exposure is much lower.
  • Comment systems remain a sticking point for static sites; suggestions include third‑party services and self‑hosted minimal systems.

Broader security observations

  • Path traversal is seen as a recurring class of bug driven by poor filesystem abstractions; one commenter promotes library support to mitigate this.
  • Logs of public servers show constant scanning for PHP exploits, with WordPress paths and leaked .env files commonly probed.
  • Some speculate AI‑driven code analysis may massively increase discovered vulnerabilities across all ecosystems, challenging assumptions about which software is “most exploitable.”