{"id":11791,"date":"2026-09-23T10:30:09","date_gmt":"2026-09-23T16:30:09","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-108-path-traversal-vulnerability-and-possible-rce-in-wordpress-core\/"},"modified":"2026-09-29T08:24:05","modified_gmt":"2026-09-29T14:24:05","slug":"alert-2026-108-path-traversal-vulnerability-and-possible-rce-in-wordpress-core","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-108-path-traversal-vulnerability-and-possible-rce-in-wordpress-core\/","title":{"rendered":"Alert 2026-108 Path Traversal Vulnerability and possible RCE in WordPress Core"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>7.1.0\u20137.1.1<\/strong><\/td>7.1.2 or higher<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>7.0.x<\/strong><\/td>7.0.6 or higher<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>6.9.x<\/strong><\/td>6.9.9 or higher<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>6.8.x<\/strong><\/td>6.8.10 or higher<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>6.7.x<\/strong><\/td>6.7.9 or higher<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>6.6.x<\/strong><\/td>6.6.9 or higher<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>Previous branches eligible for security fixes, since 4.7.0<\/strong><\/td>Apply the corresponding security backport<\/em>; WordPress published fixes up to 4.7.37<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Description<\/h2>\n\n

A vulnerability labeled CVE\u20112026\u201187902<\/strong> was published, which is critical of path traversal<\/em> type and local PHP file loading (Local File Inclusion, LFI<\/strong>) in WordPress Core. The flaw has a CVSS v4.0 score of 9.2<\/strong> and allows an unauthenticated remote attacker to force WordPress to include a readable local PHP file located outside the active theme directories. Under certain theme and server conditions, the issue can lead to remote code execution (RCE)<\/strong> and full site takeover.<\/p>\n\n

CVE\u20112026\u201187902<\/strong> is a vulnerability of inadequate control of file names in PHP include\/require operations<\/strong>, classified as CWE\u201198<\/strong>. The issue lies in the logic with which WordPress resolves the template file of a page, especially in the get_page_template() and locate_template() functions.<\/p>\n\n

In vulnerable versions, a part of the URL can be used to construct the name of a template in the format page-{value}.php<\/em><\/strong> without correctly validating traversal sequences such as ..\/<\/em><\/strong>. An unauthenticated attacker can manipulate that value to direct the template resolution process toward a readable local PHP file outside the allowed directories of the active theme.<\/p>\n\n

Solution<\/h2>\n\n

The definitive solution is to install WordPress 7.1.2<\/strong> or the corresponding security backport<\/em> for the supported branch. WordPress does not provide an independent workaround<\/em> that eliminates the vulnerability.<\/p>\n\n

The update can be performed via:<\/p>\n\n