AIKIDO-2026-899299

johnpbloch/wordpress-core is vulnerable to Path Traversal

Path TraversalCVE-2026-87902 Published Today

Critical Risk

This Affects:

johnpbloch/wordpress-core

4.7.0 - 4.7.36

Fixed in 4.7.37

4.8.0 - 4.8.31

Fixed in 4.8.32

4.9.0 - 4.9.32

Fixed in 4.9.33

5.0.0 - 5.0.28

Fixed in 5.0.29

5.1.0 - 5.1.25

Fixed in 5.1.26

5.2.0 - 5.2.27

Fixed in 5.2.28

5.3.0 - 5.3.24

Fixed in 5.3.25

5.4.0 - 5.4.22

Fixed in 5.4.23

5.5.0 - 5.5.21

Fixed in 5.5.22

5.6.0 - 5.6.20

Fixed in 5.6.21

5.7.0 - 5.7.18

Fixed in 5.7.19

5.8.0 - 5.8.16

Fixed in 5.8.17

5.9.0 - 5.9.17

Fixed in 5.9.18

6.0.0 - 6.0.15

Fixed in 6.0.16

6.1.0 - 6.1.13

Fixed in 6.1.14

6.2.0 - 6.2.12

Fixed in 6.2.13

6.3.0 - 6.3.11

Fixed in 6.3.12

6.4.0 - 6.4.11

Fixed in 6.4.12

6.5.0 - 6.5.11

Fixed in 6.5.12

6.6.0 - 6.6.8

Fixed in 6.6.9

6.7.0 - 6.7.8

Fixed in 6.7.9

6.8.0 - 6.8.9

Fixed in 6.8.10

6.9.0 - 6.9.8

Fixed in 6.9.9

7.0.0 - 7.0.5

Fixed in 7.0.6

7.1.0 - 7.1.1

Fixed in 7.1.2

Are you affected? Scan for Free

TL;DR

get_page_template() resolves a page template from attacker-influenced input without confining the resulting path to the active theme directories. An unauthenticated request can therefore cause WordPress to include a chosen readable local .php file outside the theme. When the active child or parent theme has a top-level directory whose name starts with page- (for example page-templates) and a suitable local PHP file is readable by the web server, that include becomes remote code execution. The fix restricts page-template resolution so paths cannot escape the theme directories.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and the active child or parent theme contains a top-level directory whose name starts with page-. Reaching code execution also requires a readable local .php file on the server (for example pearcmd.php when register_argc_argv is On).

Background info

johnpbloch/wordpress-core is vulnerable to Path Traversal in versions 7.1.0 - 7.1.1, 7.0.0 - 7.0.5, 6.9.0 - 6.9.8, 6.8.0 - 6.8.9, 6.7.0 - 6.7.8, 6.6.0 - 6.6.8, 6.5.0 - 6.5.11, 6.4.0 - 6.4.11, 6.3.0 - 6.3.11, 6.2.0 - 6.2.12, 6.1.0 - 6.1.13, 6.0.0 - 6.0.15, 5.9.0 - 5.9.17, 5.8.0 - 5.8.16, 5.7.0 - 5.7.18, 5.6.0 - 5.6.20, 5.5.0 - 5.5.21, 5.4.0 - 5.4.22, 5.3.0 - 5.3.24, 5.2.0 - 5.2.27, 5.1.0 - 5.1.25, 5.0.0 - 5.0.28, 4.9.0 - 4.9.32, 4.8.0 - 4.8.31 and 4.7.0 - 4.7.36.