WordPress page-template traversal can write PHP and execute code without authentication on affected configurations.

The complete chain depends on an affected theme layout and a readable local execution target such as pearcmd.php, which can turn local inclusion into an attacker-controlled PHP write.