WordPress Unauthenticated Path Traversal CVE-2025-49102 Leading to RCE

WordPress Unauthenticated Path Traversal Vulnerability (GHSA-7hp8-65ch-5whp) Vulnerability Overview Type: Unauthenticated Path Traversal Impact: Conditional Remote Code Execution (RCE) via resolution Severity: Critical (CVSS 9.2 / 10) CVE ID: CVE-2025-49102 Reporter: Robert Ressel Affected Scope Affected Versions: 7.1.0 - 7.1.1, 7.0.0 - 7.0.5, 6.9.0 - 6.9.8, 6.8.0 - 6.8.9, 6.7.0 - 6.7.8, 6.6.0 - 6.6.8, 6.5.0 - 6.5.11, 6.4.0 - 6.4.11, 6.3.0 - 6.3.11, 6.2.0 - 6.2.12, 6.1.0 - 6.1.13, 6.0.0 - 6.0.15, 5.9.0 - 5.9.17, 5.8.0 - 5.8.16, 5.7.0 - 5.7.18, 5.6.0 - 5.6.20, 5.5.0 - 5.5.21, 5.4.0 - 5.4.22, 5.3.0 - 5.3.24, 5.2.0 - 5.2.27, 5.1.0 - 5.1.25, 5.0.0 - 5.0.28, 4.9.0 - 4.9.32, 4.8.0 - 4.8.31, 4.7.0 - 4.7.38 Fixed Versions: 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12, 6.4.12, 6.3.12, 6.2.13, 6.1.14, 6.0.16, 5.9.18, 5.8.17, 5.7.19, 5.6.21, 5.5.22, 5.4.23, 5.3.25, 5.2.28, 5.1.26, 5.0.29, 4.9.33, 4.8.32, 4.7.37 Vulnerability Description An unauthenticated attacker can include a chosen readable local file (located outside the active theme directory) through the page template resolution process. If the server environment and active theme meet specific preconditions, this can lead to RCE. Preconditions The active child theme or parent theme must contain a top-level directory with a name starting with (e.g., ). This affects legacy themes such as Twenty Twelve and Twenty Fourteen, as well as certain third-party themes like Nova, Hestia, and Sydney. The chosen local target file must exist on the server and be readable by the web server user. For example, the known conversion is usable for this purpose when is set to . Official mirrors used in Docker are affected, as are default cPanel configurations when the PHP version is 8.5. Remediation WordPress 7.1.2 has been released, including the fix for this vulnerability. As a courtesy to users on older branches, the fix has been backported to all branches down to version 4.7. Exploitation Code/POC The page does not contain full POC code or exploit code; it only mentions the exploitation path: (Usable for this purpose when is set to )

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Unauthenticated Path Traversal CVE-2025-49102 Leading to RCE

More from this source