How the Double Decode Becomes a Local File Include
PHP first URL-decodes the public `pagename` query value. WordPress query hardening applies `wp_basename()` and `sanitize_title_for_query()`, but percent-encoded octets can survive because no literal slash exists yet. The vulnerable `get_page_template()` code calls `urldecode()` again, materializing `../` only after that earlier processing. It then constructs `page-<decoded value>.php`; `locate_template()` joins the candidate to the active theme and the template loader includes the result. Exploitation requires a POST, any existing published post or page ID, and an active classic theme with a subdirectory beginning `page-`. Block themes are not affected by this PHP-template path. GET probes redirect and do not execute. The include can reach outside the document root, but its target must end in `.php`.
BitFire FREE Blocks the Exploit Before WordPress Runs
BitFire FREE WAF protection inspects the URL and query string before WordPress processes them. This attack must carry recognizable double-encoded path-traversal octets in `pagename`; generic web-attack blocking detects that traversal/server-side-include pattern and rejects the request. The vulnerable second decode therefore never executes, no template path escapes the theme, and the attacker-selected PHP file is never included. This behavior-based protection does not wait for a CVE-specific virtual patch, which is decisive while this issue remains unassigned. BitFire Bot Protection adds an independent delivery barrier: unknown or restricted bots cannot submit the required POST, and fake browsers must pass JavaScript verification before restricted actions. A real verified browser can pass that client check, but the WAF still evaluates its malicious payload. These FREE request-layer controls are available to eligible non-commercial websites; commercial sites require the appropriate license.
WordPress 7.1.2 Closes Both Trust-Boundary Failures
Update to WordPress 7.1.2 immediately. The first fix requires the decoded page name to pass `validate_file()` before it may enter the template hierarchy, blocking `../`, `./`, and drive-letter paths at the source. A second defense in `locate_template()` checks traversal-bearing candidates with `realpath()` and permits only approved theme locations or `wp-includes/theme-compat`. Lab verification described in the supplied analysis confirmed that the patched file stopped inclusion from uploads, inclusion outside the document root, and disclosure of `.php`-suffixed files while normal rendering continued. WAF protection is a strong immediate barrier, not a substitute for removing the vulnerable Core code.
If Your Site Was Affected, Investigate for Persistence.
Patching closes the known template-resolution path but does not remove an earlier compromise. Any site that ran WordPress 7.1.1 or earlier with a qualifying classic or child theme should investigate now, remove discovered persistence, and rotate relevant WordPress, hosting, database, SSH, and SFTP credentials. BitFire Threat Hunter performs the deeper post-compromise review this incident demands. It can discover backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and droppers capable of restoring malware or reinfecting the site. Review access logs for matching POSTs and redirected GET probes, but do not treat the absence of an obvious malicious file as proof that the site is clean.
Deploy BitFire FREE and Patch WordPress Now
BitFire FREE delivers immediate, practical protection against this newly disclosed attack: Bot Protection shuts down automated POST delivery, and the WAF blocks the double-encoded traversal before vulnerable WordPress code can resolve or include a file. Enable BitFire, upgrade every affected site to WordPress 7.1.2, and use Threat Hunter to investigate systems that ran a vulnerable configuration. Layered prevention plus disciplined incident response is the fastest route from urgent disclosure to a defensible WordPress deployment.
