Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

tptacek · 1790096527 · focus · HN ↗
These CVSS scores don't mean anything and it would be better for everyone if they stopped showing up in headlines. This is a somewhat situational Wordpress RCE that impacts only a couple themes.
1. dofm · 1790097618 · focus · HN ↗
  Not sure if it’s a couple. Devs routinely make heavily edited copies of the core themes so there will be many, many unpublished themes that use the “page-“ prefix for templates; it was (is?) a reasonably common convention.
  (No particular disagreement with the rest of your comment though)

Unofficial Hacker News client; not affiliated with Y Combinator.