Comment by vntok | Hacker News Reader

Comment by vntok | Hacker News Reader

Parent Full thread

> This is a somewhat situational Wordpress RCE that impacts only a couple themes. reply

That is dangerously incorrect, a whole lot of themes are vulnerable. The main pre-condition, "presence of a top-level directory named 'page-xxx' like 'page-templates' in the theme's directory" is actually an official recommendation in the WordPress documentation.

See here: https://developer.wordpress.org/themes/classic-themes/templa...

> As discussed in Organizing Theme Files, WordPress can recognize page templates stored in the theme’s root folder or in a first-level subdirectory of the theme folder. *The page-templates/ folder is a common convention* for organizing global page templates, but it is not required. Page templates can also be stored in other first-level subdirectories, such as templates/ or page_templates/.

I'm not sure I understand. That's the main pre-condition... to include an arbitrary PHP that is already in the server.

On a fresh WP install, a random user can't upload PHP files. Normally you don't even need to allow random users to register an account since avatars on comments come from gravatar anyway.

> On a fresh WP install, a random user can't upload PHP files.

Indeed, but you don't need to upload anything as long as there's already a PHP file that allows you to execute arbitrary commands somewhere on the server, right?

Well, as it turns out, the default PHP Docker image has had such a file readily available until version 8.5 =)

Jesus. I don't think WP is nice to use, but people are saying WP is crap because someone else made pearcmd.php that allows you to run arbitrary commands, and then a third someone else included that in the default PHP docker image. In this case all PHP CMS's are a directory traversal bug away from this CVE.

Indeed. Then again, it's on WordPress not to have directory traversal flaws in their core functions...

- especially the functions that are explicitely exposed to be used on front-facing interfaces (ie: templating functions).

- and especially when the security flaw in question was not only raised 9 years ago but described in details on the official documentation page of the affected function

Yeah not sure why you’re being downvoted when the built in themes are vulnerable as is the default docker image pre php8.5 which a lot of people use as a base and I bet a lot of hosting providers use as well behind the scenes.

Reply on news.ycombinator.com