# WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE

Author-role user races media finalize/sideload/post-process in WordPress 7.1 to write PHP-executable image derivatives via Content-Disposition filename and XMP PHP payload.

- Payout: not disclosed
- Severity: high
- Program: WordPress
- Credited: mappymappy123
- Disclosed: 2026-10-21
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/3923967
- Library page: https://bugbountylibrary.com/r/h1%3A3923967
- Tags: domain:web impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:chained technique:race-window vuln:file-upload vuln:race-condition vuln:rce

**Target:** WordPress REST media endpoints (/wp-json/wp/v2/media, /finalize, /post-process)
**Root cause:** download_url() honors remote Content-Disposition filename, finalize_item() persists attacker-controlled original_image metadata without validation, and the image editor reuses the .php source extension for derivatives while sniffing format from contents.
**Steps:**
1. Upload image via `POST /wp-json/wp/v2/media?generate_sub_sizes=false`
2. Poison metadata: `POST /wp-json/wp/v2/media/{id}/finalize` with `original_image` pointing to attacker-chosen `.php` temp path
3. Sideload attacker JPEG via `POST /wp-json/wp/v2/media` with `url` param; server returns `Content-Disposition: attachment; filename=payload.php`
4. Race `POST /wp-json/wp/v2/media/{id}/post-process?action=create-image-subsizes` against the temp `.php` file
5. Imagick sniffs JPEG contents, generates persistent `.php` sub-size derivatives containing XMP PHP payload
6. Request generated `.php` derivative over HTTP to execute `phpinfo()`
**How found:** Code review of the new 7.1 media finalize/sideload/post-process REST flows; noticed download_url() trusts remote Content-Disposition, finalize_item() assigns original_image unchecked, and the image editor reuses source extension when MIME is unknown, then chained them via a race.
**Exploitation:** Authenticated Author uploads image, poisons original_image metadata via finalize, then races a URL sideload (with Content-Disposition .php filename) against post-process so Imagick writes persistent .php derivatives embedding PHP from XMP metadata; derivatives are then fetched unauthenticated to execute as the web user.
**Escalation:** Persistent PHP derivatives survive temp deletion, are web-accessible unauthenticated, and can leak wp-config secrets or create admin accounts for full site takeover.
**Insight:** When a framework sniffs image format from contents but reuses the source filename extension for derivatives, any path that lets an attacker influence the temp filename (e.g. remote Content-Disposition) can smuggle an executable extension past MIME checks; race the sniff window against a metadata-poisoning endpoint.