WordPress Vulnerabilities

WP < 7.1.1 - Author+ Path Traversal via Templates REST API

Description

WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal.

Affects WordPress

7.1
Fixed in WordPress 7.1.1
7.0.4
Fixed in WordPress 7.0.5
7.0.3
Fixed in WordPress 7.0.5
7.0.2
Fixed in WordPress 7.0.5
7.0.1
Fixed in WordPress 7.0.5
7.0
Fixed in WordPress 7.0.5
6.9.7
Fixed in WordPress 6.9.8
6.9.6
Fixed in WordPress 6.9.8
6.9.5
Fixed in WordPress 6.9.8
6.9.4
Fixed in WordPress 6.9.8
6.9.3
Fixed in WordPress 6.9.8
6.9.2
Fixed in WordPress 6.9.8
6.9.1
Fixed in WordPress 6.9.8
6.9
Fixed in WordPress 6.9.8
6.8.8
Fixed in WordPress 6.8.9
6.8.7
Fixed in WordPress 6.8.9
6.8.6
Fixed in WordPress 6.8.9
6.8.5
Fixed in WordPress 6.8.9
6.8.4
Fixed in WordPress 6.8.9
6.8.3
Fixed in WordPress 6.8.9
6.8.2
Fixed in WordPress 6.8.9
6.8.1
Fixed in WordPress 6.8.9
6.8
Fixed in WordPress 6.8.9
6.7.7
Fixed in WordPress 6.7.8
6.7.6
Fixed in WordPress 6.7.8
6.7.5
Fixed in WordPress 6.7.8
6.7.4
Fixed in WordPress 6.7.8
6.7.3
Fixed in WordPress 6.7.8
6.7.2
Fixed in WordPress 6.7.8
6.7.1
Fixed in WordPress 6.7.8
6.7
Fixed in WordPress 6.7.8
6.6.7
Fixed in WordPress 6.6.8
6.6.6
Fixed in WordPress 6.6.8
6.6.5
Fixed in WordPress 6.6.8
6.6.4
Fixed in WordPress 6.6.8
6.6.3
Fixed in WordPress 6.6.8
6.6.2
Fixed in WordPress 6.6.8
6.6.1
Fixed in WordPress 6.6.8
6.6
Fixed in WordPress 6.6.8
6.5.10
Fixed in WordPress 6.5.11
6.5.9
Fixed in WordPress 6.5.11
6.5.8
Fixed in WordPress 6.5.11
6.5.7
Fixed in WordPress 6.5.11
6.5.6
Fixed in WordPress 6.5.11
6.5.5
Fixed in WordPress 6.5.11
6.5.4
Fixed in WordPress 6.5.11
6.5.3
Fixed in WordPress 6.5.11
6.5.2
Fixed in WordPress 6.5.11
6.5
Fixed in WordPress 6.5.11
6.4.10
Fixed in WordPress 6.4.11
6.4.9
Fixed in WordPress 6.4.11
6.4.8
Fixed in WordPress 6.4.11
6.4.7
Fixed in WordPress 6.4.11
6.4.6
Fixed in WordPress 6.4.11
6.4.5
Fixed in WordPress 6.4.11
6.4.4
Fixed in WordPress 6.4.11
6.4.3
Fixed in WordPress 6.4.11
6.4.2
Fixed in WordPress 6.4.11
6.4.1
Fixed in WordPress 6.4.11
6.4
Fixed in WordPress 6.4.11
6.3.10
Fixed in WordPress 6.3.11
6.3.9
Fixed in WordPress 6.3.11
6.3.8
Fixed in WordPress 6.3.11
6.3.7
Fixed in WordPress 6.3.11
6.3.6
Fixed in WordPress 6.3.11
6.3.5
Fixed in WordPress 6.3.11
6.3.4
Fixed in WordPress 6.3.11
6.3.3
Fixed in WordPress 6.3.11
6.3.2
Fixed in WordPress 6.3.11
6.3.1
Fixed in WordPress 6.3.11
6.3
Fixed in WordPress 6.3.11
6.2.11
Fixed in WordPress 6.2.12
6.2.10
Fixed in WordPress 6.2.12
6.2.9
Fixed in WordPress 6.2.12
6.2.8
Fixed in WordPress 6.2.12
6.2.7
Fixed in WordPress 6.2.12
6.2.6
Fixed in WordPress 6.2.12
6.2.5
Fixed in WordPress 6.2.12
6.2.4
Fixed in WordPress 6.2.12
6.2.3
Fixed in WordPress 6.2.12
6.2.2
Fixed in WordPress 6.2.12
6.2.1
Fixed in WordPress 6.2.12
6.2
Fixed in WordPress 6.2.12
6.1.12
Fixed in WordPress 6.1.13
6.1.11
Fixed in WordPress 6.1.13
6.1.10
Fixed in WordPress 6.1.13
6.1.9
Fixed in WordPress 6.1.13
6.1.8
Fixed in WordPress 6.1.13
6.1.7
Fixed in WordPress 6.1.13
6.1.6
Fixed in WordPress 6.1.13
6.1.5
Fixed in WordPress 6.1.13
6.1.4
Fixed in WordPress 6.1.13
6.1.3
Fixed in WordPress 6.1.13
6.1.2
Fixed in WordPress 6.1.13
6.1.1
Fixed in WordPress 6.1.13
6.1
Fixed in WordPress 6.1.13
6.0.14
Fixed in WordPress 6.0.15
6.0.13
Fixed in WordPress 6.0.15
6.0.12
Fixed in WordPress 6.0.15
6.0.11
Fixed in WordPress 6.0.15
6.0.10
Fixed in WordPress 6.0.15
6.0.9
Fixed in WordPress 6.0.15
6.0.8
Fixed in WordPress 6.0.15
6.0.7
Fixed in WordPress 6.0.15
6.0.6
Fixed in WordPress 6.0.15
6.0.5
Fixed in WordPress 6.0.15
6.0.4
Fixed in WordPress 6.0.15
6.0.3
Fixed in WordPress 6.0.15
6.0.2
Fixed in WordPress 6.0.15
6.0.1
Fixed in WordPress 6.0.15
6.0
Fixed in WordPress 6.0.15
5.9.16
Fixed in WordPress 5.9.17
5.9.15
Fixed in WordPress 5.9.17
5.9.14
Fixed in WordPress 5.9.17
5.9.13
Fixed in WordPress 5.9.17
5.9.12
Fixed in WordPress 5.9.17
5.9.11
Fixed in WordPress 5.9.17
5.9.10
Fixed in WordPress 5.9.17
5.9.9
Fixed in WordPress 5.9.17
5.9.8
Fixed in WordPress 5.9.17
5.9.7
Fixed in WordPress 5.9.17
5.9.6
Fixed in WordPress 5.9.17
5.9.5
Fixed in WordPress 5.9.17
5.9.4
Fixed in WordPress 5.9.17
5.9.3
Fixed in WordPress 5.9.17
5.9.2
Fixed in WordPress 5.9.17
5.9.1
Fixed in WordPress 5.9.17
5.9
Fixed in WordPress 5.9.17

References

URL
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Anthropic
Verified
Yes
WPVDB ID
eecc3b64-892b-43a8-9da8-457bd311fc55

Timeline

Publicly Published
2026-09-17 (about 1 month ago)
Added
2026-09-18 (about 1 month ago)
Last Updated
2026-09-18 (about 1 month ago)

Other

Published
Title
Published
2022-12-21
Title
Images Optimize and Upload CF7 < 2.2.1 - Unauthenticated Arbitrary File Deletion
Published
2026-04-16
Title
Unlimited Elements For Elementor < 2.0.7 - Contributor+ Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
Published
2026-05-12
Title
Avada Builder < 3.15.3 - Subscriber+ Arbitrary File Read via 'custom_svg' Shortcode Parameter
Published
2023-05-23
Title
WordPress File Upload < 4.19.2 - Admin+ Path Traversal
Published
2014-08-01
Title
Advanced Dewplayer <= 1.2 - download-file.php dew_file Parameter Traversal Arbitrary File Access