pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.
As the article points out, one issue is that the official Docker container for PHP has this configuration.
However at least in principle all of the affected versions [0] could be automatically updated. Not sure if they have set it to auto-update as far back as 4.7 though.
[0] except 4.9.3 which has a bug in its automatic update mechanism.
pearcmd and register_argc_argv are just examples. get_page_template was unsanitized in some themes, that's the flaw, you could then combine it with one of a million unauthorized file upload in wordpress plugins to try and eval code. An attacker would like to use upload + this chain of requires (instead of just uploading a php) because of hardened configuration and the pwn can go unnoticed in the logs.
Also, with pearcmd (if you can get to that, there's no open_basedir) and containers a novice sysadmin will publish insecure sites.
It's not clear to me: do we need to both apply the patch _and_ check if our themes are vulnerable, or just apply the patch?
Edit: looking at the patch itself it looks like it fixes the root cause and so it shouldn't matter what themes are doing themselves. But possibly I'm reading it incorrectly.
Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw:
Paul Ryan 9 years ago
Note that locate_template() does not prevent directory traversal attacks, so if you’re passing a user-provided template name to the function, be sure to verify that it’s from one of the three appropriate locations (active theme directory, parent theme directory, or /wp-includes/theme-compat/ directory).
Ahahah I remember to have patched themes for clients by hand, years ago. A different time, where a core team would for whatever reason leave security holes around to be sure you need three frameworks around their pile of dung code.
These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
TBF, some of it is structural: if you're the most popular anything on the internet, you'll be the most attacked and the most exploited, and hence the most exploitable.
The access log of public http servers is truly interesting to watch.
You know that the scripts doing it are optimized for success rate, so the types of requests they send give you an impression of what's actually out there.
It's clear to me that once we finally achieve rogue AGI, it is going to propagate through unpatched WordPress WooCommerce instances.
If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates.
People on HN love to talk smack about WordPress. After all these years, it's as much a reflex as shouting "walled garden!" every time there's an Apple story.
Yet some of the biggest web sites on the internet run WordPress, and more importantly, some of the biggest hacking targets on the internet run WordPress.
Prime example: whitehouse.gov.
If you know what you're doing, WordPress fine. The same is true with every other piece of technology out there.
But people on HN like to lump the good in with the bad because everything is binary.
If you know what you're doing, a loaded gun without a safety is fine, too. But you have the option, why not pick the unloaded one with a safety mechanism?
I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
When I finally got approval to rewrite the company blog from Wordpress into something that was mostly static, it was the best week. I used PHP to do mobile/desktop and language selection, because PHP is pretty useful, and it can be pretty fast and secure if you only do simple things.
Never had to worry again about sequencing updates where the update changed the database schema and I had a cluster of 6 web servers. Never had to worry anymore about long ass load times because the web servers were in 3 colos and wordpress wouldn't play nice with local read only mysql replicas. No more worries about why pingbacks and comments keep showing up in the database even those those features were turned off; at least they weren't showing up in a moderation queue, but still.
You can make the most intricate drag and drop admin interfaces to allow the editor to customize everything, and they will still call you to put up every post, so might as well go static
WordPress really is a piece of garbage software, and if you've ever developed plugins for it it is soooo apparent.
The documentation is a perfect reflection of the absolute mess of spaghetti code that it is, half of the methods that you will use constantly when developing plugins are undocumented, even untyped. It's literally unusable.
I know WordPress is good thanks to its ecosystem, but really, really, do NOT use it.
pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.
As the article points out, one issue is that the official Docker container for PHP has this configuration.
However at least in principle all of the affected versions [0] could be automatically updated. Not sure if they have set it to auto-update as far back as 4.7 though.
[0] except 4.9.3 which has a bug in its automatic update mechanism.
pearcmd and register_argc_argv are just examples. get_page_template was unsanitized in some themes, that's the flaw, you could then combine it with one of a million unauthorized file upload in wordpress plugins to try and eval code. An attacker would like to use upload + this chain of requires (instead of just uploading a php) because of hardened configuration and the pwn can go unnoticed in the logs.
Also, with pearcmd (if you can get to that, there's no open_basedir) and containers a novice sysadmin will publish insecure sites.
hmm, this may be why i just saw an unexpected update to a very old theme.
It's not clear to me: do we need to both apply the patch _and_ check if our themes are vulnerable, or just apply the patch?
Edit: looking at the patch itself it looks like it fixes the root cause and so it shouldn't matter what themes are doing themselves. But possibly I'm reading it incorrectly.
Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw:
https://developer.wordpress.org/reference/functions/locate_t...
Ahahah I remember to have patched themes for clients by hand, years ago. A different time, where a core team would for whatever reason leave security holes around to be sure you need three frameworks around their pile of dung code.
These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
And its closely related cousin, Joomla.
Joomla makes WP look like Fort Knox.
TBF, some of it is structural: if you're the most popular anything on the internet, you'll be the most attacked and the most exploited, and hence the most exploitable.
That's not really true.
nginx serves a third of web traffic.
The access log of public http servers is truly interesting to watch.
You know that the scripts doing it are optimized for success rate, so the types of requests they send give you an impression of what's actually out there.
It's clear to me that once we finally achieve rogue AGI, it is going to propagate through unpatched WordPress WooCommerce instances.
Not success rate per request though.
If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates.
People on HN love to talk smack about WordPress. After all these years, it's as much a reflex as shouting "walled garden!" every time there's an Apple story.
Yet some of the biggest web sites on the internet run WordPress, and more importantly, some of the biggest hacking targets on the internet run WordPress.
Prime example: whitehouse.gov.
If you know what you're doing, WordPress fine. The same is true with every other piece of technology out there.
But people on HN like to lump the good in with the bad because everything is binary.
Probably true, but for whatever reason Wordpress seems to attract an awful lot of people that do not know what they are doing
If you know what you're doing, a loaded gun without a safety is fine, too. But you have the option, why not pick the unloaded one with a safety mechanism?
The patch (identified from https://github.com/WordPress/wordpress-develop/compare/7.1.1...):
https://github.com/WordPress/wordpress-develop/commit/9c4e85...
It's crazy to me that WP still doesn't make use of proper function type declarations, 11 years after they were added to PHP.
I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
Sorry in advance if you were joking, but for readers who aren't in the know: Hugo had, in fact, two 9.3 CVSS vulnerabilities just 11 days ago...
https://app.opencve.io/cve/CVE-2026-89259
https://app.opencve.io/cve/CVE-2026-89258
To be clear, those are CVEs in the tooling, not in the generated static sites. Not great, but very different from this WordPress CVE
When I finally got approval to rewrite the company blog from Wordpress into something that was mostly static, it was the best week. I used PHP to do mobile/desktop and language selection, because PHP is pretty useful, and it can be pretty fast and secure if you only do simple things.
Never had to worry again about sequencing updates where the update changed the database schema and I had a cluster of 6 web servers. Never had to worry anymore about long ass load times because the web servers were in 3 colos and wordpress wouldn't play nice with local read only mysql replicas. No more worries about why pingbacks and comments keep showing up in the database even those those features were turned off; at least they weren't showing up in a moderation queue, but still.
You can make the most intricate drag and drop admin interfaces to allow the editor to customize everything, and they will still call you to put up every post, so might as well go static
Is there a good replacement for wordpress comments? That's the one thing holding me back from porting at the moment.
WordPress really is a piece of garbage software, and if you've ever developed plugins for it it is soooo apparent.
The documentation is a perfect reflection of the absolute mess of spaghetti code that it is, half of the methods that you will use constantly when developing plugins are undocumented, even untyped. It's literally unusable.
I know WordPress is good thanks to its ecosystem, but really, really, do NOT use it.