Critical WordPress Vulnerability Enables Remote Code Execution – What You Need to Know

WordPress powers over half of the internet’s websites, making its security vital to millions. Recently, a critical vulnerability rated 8.1 out of 10 has been discovered affecting the WordPress Core system. This flaw allows unauthenticated attackers to perform a path traversal attack that can enable them to include local PHP files and, under certain conditions, execute malicious code remotely (Remote Code Execution or RCE).

How Does This Vulnerability Work?

The vulnerability exploits the getpagetemplate() function in WordPress. An attacker can manipulate the page-template resolution process to include a chosen readable PHP file from outside the theme directories. This path traversal means files not intended for web exposure can be loaded and executed by the server.

However, not every WordPress site is equally at risk. To be vulnerable to full code execution, the site must meet these conditions:

• Use a parent or child theme with a top-level folder named starting with "page-" (e.g., "page-templates").
• Have a local PHP file readable by the web server that can be targeted.
• The web server account must have permissions to read the included file. Systems using PHP’s registerargcargv setting active can be more vulnerable, as some specific files like pearcmd.php might be exploited.

Common hosting setups such as the official PHP Docker image and default cPanel configurations are affected if running PHP versions below 8.5.

What Are Attackers Doing and How Widespread Is the Threat?

Exploitation attempts began within hours after a patch was published. Initially, attackers conducted reconnaissance by probing harmless files to identify vulnerable sites. Shortly after, they escalated to delivering malicious payloads aimed at gaining control of affected websites.

This escalation has led to widespread scanning and exploitation, originating from hundreds of IP addresses. Early blocking of a small number of IPs proved ineffective as the attack sources diversified.

Malicious actors have used this flaw not just for information gathering but to write PHP files to disk on targeted servers, marking a significant risk of complete site takeover.

Immediate Actions Website Administrators Should Take

Update WordPress immediately: The critical flaw is fixed in WordPress version 7.1.2 and patches have been backported to versions as far back as 4.7. Versions prior to 4.8 will not receive fixes and these should be upgraded as soon as possible.

Apply interim mitigations if immediate updating is not feasible:

• Block requests containing directory traversal patterns (such as "../") in the pagename parameter, since legitimate page slugs never include these sequences.
• Disable the PHP registerargcargv directive to break the chain to exploit files like pearcmd.php. This does not fix the file inclusion but can prevent escalation to remote code execution.

Reliance on IP blocking alone is insufficient due to the volume and decentralization of attacking sources.

What Does This Mean for Your Website’s Security?

If exploited, this vulnerability can lead to attackers fully compromising your website, including installing backdoors, defacing pages, or using your server for malicious activities like spamming or spreading malware. Because WordPress sites are often targeted for their widespread use, timely updates and patch management are critical defenses.

Administrators should prioritize patching and monitor web server logs for suspicious activity related to unexpected file accesses or changes.