WordPress: Unauthenticated path traversal leading to conditional RCE

Re:WordPress: Unauthenticated path traversal leading to cond... by AlienRobot on Tuesday September 22, 2026 @07:11PM (#49809572)

I'm not sure I understand. That's the main pre-condition... to include an arbitrary PHP that is already in the server.

On a fresh WP install, a random user can't upload PHP files. Normally you don't even need to allow random users to register an account since avatars on comments come from gravatar anyway.

[ Parent | on HN ]

Re:WordPress: Unauthenticated path traversal leading to cond... by vntok on Wednesday September 23, 2026 @07:57AM (#49814748)

> On a fresh WP install, a random user can't upload PHP files.

Indeed, but you don't need to upload anything as long as there's already a PHP file that allows you to execute arbitrary commands somewhere on the server, right?

Well, as it turns out, the default PHP Docker image has had such a file readily available until version 8.5 =)

[ Parent | on HN ]

Re:WordPress: Unauthenticated path traversal leading to cond... by AlienRobot on Wednesday September 23, 2026 @12:33PM (#49818662)

Jesus. I don't think WP is nice to use, but people are saying WP is crap because someone else made pearcmd.php that allows you to run arbitrary commands, and then a third someone else included that in the default PHP docker image. In this case all PHP CMS's are a directory traversal bug away from this CVE.

[ Parent | on HN ]

Re:WordPress: Unauthenticated path traversal leading to cond... by vntok on Thursday September 24, 2026 @05:31AM (#49828267)

Indeed. Then again, it's on WordPress not to have directory traversal flaws in their core functions...

- especially the functions that are explicitely exposed to be used on front-facing interfaces (ie: templating functions).

- and especially when the security flaw in question was not only raised 9 years ago but described in details on the official documentation page of the affected function

[ Parent | on HN ]