Retraceur 4.4.0: Security release

Please update to 4.4.0 as soon as possible.

This release fixes a critical security vulnerability in page template resolution. Under certain conditions, an unauthenticated attacker could manipulate the pagename parameter to cause a chosen, readable PHP file located outside the active theme’s directories to be loaded, which, depending on server configuration and the active theme, could lead to remote code execution.

The fix ensures that every template path resolved by locate_template() stays confined to legitimate theme directories (the active theme’s directory, its parent theme, and wp-includes/theme-compat), and also hardens get_page_template() by validating the decoded parameter before it’s used.

This backports, for Retraceur, the fix released in WordPress^® 7.0.6. A big thank you to Robert Ressl for discovering and responsibly disclosing this vulnerability, and to the WordPress^® security team.

Featured photo : Gabriele Romano on Unsplash

Note: The WordPress^® trademark is the intellectual property of the WordPress^® Foundation. The use of the WordPress^® name in this article is for identification purposes only and does not imply endorsement by the WordPress^® Foundation.