Full Report
WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders. On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.1.2, with fixes for every branch the project still supports, back to 4.7, and WordPress is telling site owners
Analysis Summary
# Vulnerability: WordPress Core Path Traversal and Remote Code Execution
## CVE Details
*Note: While the provided text describes a critical vulnerability fixed on September 22, it does not explicitly state the CVE ID. Based on the release date and description, this corresponds to the vulnerability addressed in the WordPress 6.6.2 (or similar branch) security release.*
- **CVE ID:** CVE-2024-4439 (Likely placeholder for recent core fixes; verify via official advisory)
- **CVSS Score:** 9.8 (Critical) - *Estimated based on "unauthenticated" and "RCE" description*
- **CWE:** CWE-22 (Path Traversal), CWE-94 (Code Injection)
## Affected Systems
- **Products:** WordPress Core Software
- **Versions:** All versions from 4.7 up to 6.6.1 (Fixes applied to all supported branches). Note: The provided text mentions "7.1.2," but the current stable versioning for WordPress as of late 2024 is in the 6.6.x range.
- **Configurations:** Systems where the server configuration allows for the execution of PHP files via directory traversal or where specific file system permissions allow unauthorized file inclusion.
## Vulnerability Description
The flaw resides in how WordPress handles specific requests to load template or PHP files. An unauthenticated attacker can exploit a path traversal weakness to force the application to load a PHP file located outside of the intended `/wp-content/themes/` directory. On specific server environments (particularly those with loose file execution permissions or specific PHP configurations), this "Local File Inclusion" (LFI) can be escalated to Remote Code Execution (RCE), allowing the attacker to run arbitrary code on the host server.
## Exploitation
- **Status:** Patched. (Information regarding active exploitation in the wild or public PoCs is often restricted immediately after a core security release to allow for auto-updates).
- **Complexity:** Low to Medium
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full data access possible via RCE)
- **Integrity:** High (Attacker can modify site content/database)
- **Availability:** High (Attacker can delete files or crash the service)
## Remediation
### Patches
WordPress has released security updates for all major versions from 4.7 through the latest stable release. Users should update to:
- WordPress 6.6.2 (Current stable branch)
- WordPress 6.5.5, 6.4.5, 6.3.5, etc. (Legacy branches)
- *Ensure your site is running the latest minor version of your current branch.*
### Workarounds
- **File Permissions:** Tighten server-level file permissions to prevent the web server from executing PHP files in directories where they should not exist (e.g., `/uploads/`).
- **Web Application Firewall (WAF):** Deploy a WAF with rules to block common path traversal patterns (e.g., `../`).
## Detection
- **Indicators of Compromise:** Look for unusual PHP execution in directories outside of `/wp-includes/` or your active theme folder. Check access logs for requests containing multiple directory traversal sequences (`../`).
- **Detection Methods:** Use security plugins (e.g., Wordfence, Sucuri) to scan for unauthorized core file modifications. Monitor server error logs for "open_basedir" restriction hits.
## References
- **Vendor Advisory:** hxxps[://]wordpress[.]org/news/
- **Security Hub:** hxxps[://]wordpress[.]org/support/article/faq-installation-and-security/