Affected Systems
WordPress core versions 4.7.0 through 7.1.1. All installations are vulnerable to path traversal; remote code execution depends on active theme having a folder starting with "page-" and server configuration (register_argc_argv enabled, presence of exploitable PHP files).
Exploitation Status
No active exploitation reported as of September 22, 2026. Proof-of-concept published by researcher Robert Ressl. Not listed in CISA KEV catalog. Privately disclosed in July 2026.
Business Impact
Unauthenticated attackers can force WordPress to load arbitrary local PHP files via path traversal in template selection logic. On vulnerable configurations (themes with "page-*" folders, register_argc_argv enabled, exploitable PHP files present), this escalates to remote code execution with web server privileges. CVSS 9.2 (critical). Older default WordPress themes contain exploitable folder structures; current default themes do not. Flaw bypasses existing traversal protections.
Urgency
🔴 Immediate
Recommended Actions
- Update all WordPress installations immediately: 7.1.x to 7.1.2, 7.0.x to 7.0.6, 6.9.x to 6.9.9, 6.8.x to 6.8.10, 6.7.x to 6.7.9, 6.6.x to 6.6.9, or appropriate backported version down to 4.7.37
- Verify automatic background updates completed successfully on managed WordPress sites via dashboard under Updates
- Audit active themes for top-level folders beginning with 'page-' to assess exposure; consider switching themes if update cannot be applied immediately
- For servers that cannot update immediately, disable register_argc_argv for web requests in PHP configuration and remove unused PEAR components as temporary risk reduction (does not fix underlying flaw)
- Monitor web server logs for suspicious requests containing '../' sequences or unusual page template parameters in URLs