An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE.

The pre-conditions are:

The active child or parent theme contains a top-level directory whose name starts with page- (e.g. page-templates ). This affects the legacy Twenty Twelve and Twenty Fourteen themes, as well as some popular third party themes such as Neve, Hestia, and Sydney.

A chosen local .php target file exists on the server and is readable by the web server account. The well known pearcmd.php PEAR→RCE transition can be used for this when register_argc_argv is set to On .…