An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE. The pre-conditions are: The active child or parent theme contains a top-level directory whose name starts with page- (e.g. page-templates ). This affects the legacy Twenty Twelve and Twenty Fourteen themes, as well as some popular third party themes such as Neve, Hestia, and Sydney. A chosen local .php target file exists on the server and is readable by the web server account. The well known pearcmd.php PEAR→RCE transition can be used for this when register_argc_argv is set to On . The official php image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use.…