# RCE as Admin defeats WordPress hardening and file permissions

Admin-controlled upload_path with path traversal makes wp_mkdir_p chmod arbitrary directories to 0777, re-enabling theme writes and yielding RCE despite hardening.

- Payout: hidden
- Severity: critical
- Program: WordPress
- Found by: simonscannell
- Disclosed: 2020-06-09
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/436928
- Library page: https://bugbountylibrary.com/r/h1%3A436928
- Tags: area:web domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:critical tech:php tech:wordpress technique:chained technique:source-review vuln:misconfiguration vuln:path-traversal vuln:rce

**Target:** wp_mkdir_p() via upload_path option in WordPress core
**Root cause:** wp_mkdir_p() derives $target_parent via dirname() on an attacker-controlled upload_path and chmods each exploded path segment with the parent's permission bits, so traversal segments let it chmod arbitrary existing directories to 0777.
**Steps:**
1. As admin, set upload_path option via wp-admin/options.php to `../../../../../../../var/tmp/content/../../../../../../home/simon/html/wordpress/../../../../../../var/tmp/content`
2. Trigger wp_upload_dir() by uploading media so wp_mkdir_p() runs
3. wp_mkdir_p resolves $target_parent to `../../../../../../../var/tmp/` (writable, perms 0777) and mkdir succeeds on realpath /var/tmp/content
4. umask check fails, so each exploded segment is chmod'd; this executes `chmod('../../../../../../../var/tmp/content/../../../../../../home/simon/html/wordpress/', 0777)`
5. Set upload_path to the theme directory, upload `shell.txt` containing `<?php phpinfo(); ?>`
6. Include the uploaded file via the _wp_page_template post meta technique from the 'RCE as Author' report to execute code
**How found:** Set up a hardened WordPress (PHP safe mode, non-writable webroot, file edit and plugin install disabled) and challenged to hack it; audited wp_mkdir_p() called from wp_upload_dir() and noticed dirname()/explode/chmod logic on the admin-controlled upload_path option.
**Exploitation:** Admin sets upload_path to a traversal payload, uploads media to trigger wp_mkdir_p, which chmods the web/theme directory to 0777. Then upload_path is pointed at the theme dir, a PHP shell is uploaded as shell.txt, and included via _wp_page_template post meta, executing arbitrary code despite non-writable webroot, disabled file edit, and disabled plugin install.
**Escalation:** Chains the chmod-to-0777 primitive with the _wp_page_template local file inclusion to convert admin-only path traversal into full RCE; notes reflected XSS could reach RCE on plugin-equipped sites.
**Insight:** When a function inherits permissions from dirname() of an attacker-influenced path and then chmods each exploded segment, traversal segments let you chmod pre-existing directories, not just create new ones — check upload_path-style options for this.