The block template resolver _get_block_template_file() built a template path by concatenating a caller-supplied slug onto the active theme’s template directory and accepted the result on nothing more than a file_exists() check. A slug containing traversal sequences therefore resolved outside the theme’s template directory, so an authenticated user who can reach the REST templates controller could have the contents of arbitrary .html files readable by the web server returned as template content. The fix canonicalises both the candidate file and the template directory with realpath() and requires the resolved file to sit under the resolved template directory before the template is accepted, storing the canonicalised path.
This vulnerability affects the following application versions:
- WordPress 5.9
- WordPress 5.9.1
- WordPress 5.9.2
- WordPress 5.9.3
- WordPress 5.9.4
- WordPress 5.9.5
- WordPress 5.9.6
- WordPress 5.9.7
- WordPress 5.9.8
- WordPress 5.9.9
- WordPress 5.9.10
- WordPress 5.9.11
- WordPress 5.9.12
- WordPress 5.9.13
- WordPress 5.9.14
- WordPress 5.9.15
- WordPress 5.9.16
- WordPress 6.0
- WordPress 6.0.1
- WordPress 6.0.2
- WordPress 6.0.3
- WordPress 6.0.4
- WordPress 6.0.5
- WordPress 6.0.6
- WordPress 6.0.7
- WordPress 6.0.8
- WordPress 6.0.9
- WordPress 6.0.10
- WordPress 6.0.11
- WordPress 6.0.12
- WordPress 6.0.13
- WordPress 6.0.14
- WordPress 6.1
- WordPress 6.1.1
- WordPress 6.1.2
- WordPress 6.1.3
- WordPress 6.1.4
- WordPress 6.1.5
- WordPress 6.1.6
- WordPress 6.1.7
- WordPress 6.1.8
- WordPress 6.1.9
- WordPress 6.1.10
- WordPress 6.1.11
- WordPress 6.1.12
- WordPress 6.2
- WordPress 6.2.1
- WordPress 6.2.2
- WordPress 6.2.3
- WordPress 6.2.4
- WordPress 6.2.5
- WordPress 6.2.6
- WordPress 6.2.7
- WordPress 6.2.8
- WordPress 6.2.9
- WordPress 6.2.10
- WordPress 6.2.11
- WordPress 6.3
- WordPress 6.3.1
- WordPress 6.3.2
- WordPress 6.3.3
- WordPress 6.3.4
- WordPress 6.3.5
- WordPress 6.3.6
- WordPress 6.3.7
- WordPress 6.3.8
- WordPress 6.3.9
- WordPress 6.3.10
- WordPress 6.4
- WordPress 6.4.1
- WordPress 6.4.2
- WordPress 6.4.3
- WordPress 6.4.4
- WordPress 6.4.5
- WordPress 6.4.6
- WordPress 6.4.7
- WordPress 6.4.8
- WordPress 6.4.9
- WordPress 6.4.10
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.5.8
- WordPress 6.5.9
- WordPress 6.5.10
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.6.5
- WordPress 6.6.6
- WordPress 6.6.7
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.1