High · published September 22, 2026
CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
| Product | Versions | Fixed in |
|---|---|---|
| wordpress/wordpress | < 4.7.37 | 4.7.37 |
| wordpress/wordpress | ≥ 4.8, < 4.8.32 | 4.8.32 |
| wordpress/wordpress | ≥ 4.9, < 4.9.33 | 4.9.33 |
| wordpress/wordpress | ≥ 5.0, < 5.0.29 | 5.0.29 |
| wordpress/wordpress | ≥ 5.1, < 5.1.26 | 5.1.26 |
| wordpress/wordpress | ≥ 5.2, < 5.2.28 | 5.2.28 |
| wordpress/wordpress | ≥ 5.3, < 5.3.25 | 5.3.25 |
| wordpress/wordpress | ≥ 5.4, < 5.4.23 | 5.4.23 |
| wordpress/wordpress | ≥ 5.5, < 5.5.22 | 5.5.22 |
| wordpress/wordpress | ≥ 5.6, < 5.6.21 | 5.6.21 |
| wordpress/wordpress | ≥ 5.7, < 5.7.19 | 5.7.19 |
| wordpress/wordpress | ≥ 5.8, < 5.8.17 | 5.8.17 |
| wordpress/wordpress | ≥ 5.9, < 5.9.18 | 5.9.18 |
| wordpress/wordpress | ≥ 6.0, < 6.0.16 | 6.0.16 |
| wordpress/wordpress | ≥ 6.1, < 6.1.14 | 6.1.14 |
| wordpress/wordpress | ≥ 6.2, < 6.2.13 | 6.2.13 |
| wordpress/wordpress | ≥ 6.3, < 6.3.12 | 6.3.12 |
| wordpress/wordpress | ≥ 6.4, < 6.4.12 | 6.4.12 |
| wordpress/wordpress | ≥ 6.5, < 6.5.12 | 6.5.12 |
| wordpress/wordpress | ≥ 6.6, < 6.6.9 | 6.6.9 |
| wordpress/wordpress | ≥ 6.7, < 6.7.9 | 6.7.9 |
| wordpress/wordpress | ≥ 6.8, < 6.8.10 | 6.8.10 |
| wordpress/wordpress | ≥ 6.9, < 6.9.9 | 6.9.9 |
| wordpress/wordpress | ≥ 7.0, < 7.0.6 | 7.0.6 |
| wordpress/wordpress | ≥ 7.1, < 7.1.2 | 7.1.2 |