proomt

Search

Search posts, papers, and topics

All posts

Hacker News front pageWordPress1 min readintermediate

WordPress: Unauthenticated path traversal leading to conditional RCE

Read on github.comHN 165·85 comments

Summary

WordPress 7.1.2 patches an unauthenticated path‑traversal in get_page_template() that lets an attacker include arbitrary readable PHP files outside the theme when a top‑level "page-" directory exists. The bug can lead to remote code execution on systems with a readable PHP payload (e.g., pearcmd.php) and register_argc_argv enabled.

  • Unauthenticated attackers can abuse get_page_template() to include any readable .php file outside the theme if the theme has a top‑level directory starting with "page-".
  • Exploitation requires a readable local PHP file (e.g., pearcmd.php) and register_argc_argv=On; Docker php image and older cPanel setups are vulnerable.
  • Affected themes include legacy Twenty Twelve/Fourteen and popular third‑party themes like Neve, Hestia, and Sydney.
  • WordPress 7.1.2 patches the issue; the fix is back‑ported to all branches back to 4.7.

WordPress site operators using affected themes or PHP configurations must upgrade to prevent remote code execution.

5/10
securityphpwordpresspath traversalrce

Related reading

  1. Laravel Scalpel Scans for Filesystem Intrusion Evidence

    Laravel Scalpel is a Laravel‑native scanner that looks for post‑deployment filesystem tampering – rogue PHP files, obfuscated backdoors, altered .htaccess/.user.ini, missing or mis‑configured .env, and diffs against a signed baseline. It ships with six built‑in scanners, baseline snapshot commands, fast vs strict hashing modes, CI‑friendly output (JSON, SARIF, GitHub annotations) and a ScanFinish…

    Laravellaravel-news.com5 min

  2. Immutability in PHP Beyond readonly

    The article walks through practical ways to achieve immutability in PHP beyond the built‑in readonly keyword, covering interior mutability, immutable value objects, collections, dates, and cloning. It also shows how to enforce and test these patterns in real codebases.

    Freek Van der Hertenfreek.dev1 min

  3. CodeSOD: Extremely One Line

    The article spotlights a legacy ASP.NET page where the Page_PreInit method is crammed onto one line, mixing user‑agent sniffing and magic strings, illustrating how such code hurts readability and maintainability.

    The Daily WTFthedailywtf.com1 min

  4. When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

    Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…

    Cloudflarecloudflare.com21 minHN2

  5. Spain Orders Blocks on Archive.today and Its Mirrors

    Spain’s Intellectual Property Commission ordered ISPs to block Archive.today and its mirrors, redirecting users to a government warning page. The block was triggered by an administrative complaint from an unnamed rights holder and follows a 2021 protocol for rapid takedown of mirror sites. No technical details or engineering analysis are provided.

    Hacker News front pagereclaimthenet.org2 minHN545425