AIKIDO-2026-477661

roots/wordpress is vulnerable to Path Traversal

Path TraversalCVE-2026-87902 Published Yesterday

Critical Risk

This Affects:

roots/wordpress

0.0.1 - 5.5.21

Fixed in 5.5.22

5.6 - 5.6.20

Fixed in 5.6.21

5.7 - 5.7.18

Fixed in 5.7.19

5.8 - 5.8.16

Fixed in 5.8.17

5.9 - 5.9.17

Fixed in 5.9.18

6.0 - 6.0.15

Fixed in 6.0.16

6.1 - 6.1.13

Fixed in 6.1.14

6.2 - 6.2.12

Fixed in 6.2.13

6.3 - 6.3.11

Fixed in 6.3.12

6.4 - 6.4.11

Fixed in 6.4.12

6.5 - 6.5.11

Fixed in 6.5.12

6.6 - 6.6.8

Fixed in 6.6.9

6.7 - 6.7.8

Fixed in 6.7.9

6.8 - 6.8.9

Fixed in 6.8.10

6.9 - 6.9.8

Fixed in 6.9.9

7.0 - 7.0.5

Fixed in 7.0.6

7.1 - 7.1.1

Fixed in 7.1.2

Are you affected? Scan for Free

TL;DR

get_page_template() resolves a page template from attacker-influenced input without confining the resulting path to the active theme directories. An unauthenticated request can therefore cause WordPress to include a chosen readable local .php file outside the theme. When the active child or parent theme has a top-level directory whose name starts with page- (for example page-templates) and a suitable local PHP file is readable by the web server, that include becomes remote code execution. The fix restricts page-template resolution so paths cannot escape the theme directories.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and the active child or parent theme contains a top-level directory whose name starts with page-. Reaching code execution also requires a readable local .php file on the server (for example pearcmd.php when register_argc_argv is On).

Background info

roots/wordpress is vulnerable to Path Traversal in versions 7.1 - 7.1.1, 7.0 - 7.0.5, 6.9 - 6.9.8, 6.8 - 6.8.9, 6.7 - 6.7.8, 6.6 - 6.6.8, 6.5 - 6.5.11, 6.4 - 6.4.11, 6.3 - 6.3.11, 6.2 - 6.2.12, 6.1 - 6.1.13, 6.0 - 6.0.15, 5.9 - 5.9.17, 5.8 - 5.8.16, 5.7 - 5.7.18, 5.6 - 5.6.20 and 0.0.1 - 5.5.21.