WordPress patches critical 9.2-rated path traversal that can lead to remote code execution

WordPress published a critical security advisory on 22 September 2026 for an unauthenticated path traversal in the resolution of page templates — a flaw that can escalate to remote code execution when certain conditions are met on the server and in the active theme. The advisory carries a CVSS score of 9.2, and the issue was responsibly disclosed by security researcher Robert Ressl.

What the flaw does

According to the advisory, an unauthenticated attacker can make get_page_template() — the function WordPress uses to decide which template file renders a page — include a chosen readable local .php file that sits outside the directories of the active theme. Because the included file is executed as PHP, meeting the right pre-conditions turns the traversal into remote code execution.

The two pre-conditions

The advisory names two requirements. First, the active child or parent theme must contain a top-level directory whose name starts with "page-", for example "page-templates". This affects the legacy Twenty Twelve and Twenty Fourteen themes, as well as popular third-party themes including Neve, Hestia and Sydney.

Second, a suitable local .php file must exist on the server and be readable by the web server account. The well-known pearcmd.php route from PEAR to code execution works for this when register_argc_argv is set to On — the official php image for Docker is affected, and so is the default cPanel configuration when PHP older than 8.5 is in use.

Affected versions and the fix

The vulnerability affects WordPress 4.7.0 through 7.1.1. WordPress 7.1.2 contains the fix, and as a courtesy to users on older branches the patch was backported to every branch back to 4.7, so each supported release line has its own patched version. Operators who cannot update immediately should at least check whether their theme ships a directory starting with "page-", and whether their PHP configuration exposes register_argc_argv.