Описание
An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
A flaw was found in WordPress. An unauthenticated attacker can exploit a vulnerability in the get_page_template() function's page-template resolution. This allows the attacker to include a chosen readable local PHP file from outside the active theme directories. If specific server and active theme pre-conditions are met, this can lead to remote code execution (RCE), enabling the attacker to run arbitrary code on the affected system.
Отчет
Red Hat Product Security rates this vulnerability as Important severity because an unauthenticated network adversary could achieve arbitrary code execution, though high attack complexity and specific environment prerequisites prevent a Critical rating. WordPress is not distributed in Red Hat Enterprise Linux core repositories, limiting exposure to community packages such as EPEL and Fedora. Supported Red Hat server installations are therefore unaffected in default configurations.
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
An unauthenticated attacker can make `get_page_template()` page-templa ...
Уязвимость функции get_page_template() ядра системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код
8.1 High
CVSS3