get_page_template() is a WordPress core function that resolves which page template file should be used for a request. It builds a template hierarchy and returns a filesystem path to the chosen PHP file. In normal operation, this is just routing logic: WordPress maps a page to the correct theme template so the site can render content consistently.
Security matters when template selection can be influenced by unexpected input or by unsafe theme and file layouts. If an attacker can steer the resolved path toward an unintended local PHP file, the issue can resemble file-inclusion abuse and may become a path to remote code execution in certain environments. Defenders review template logic, theme structure, and file permissions, then patch WordPress and remove writable or readable PHP files that should not be reachable through normal template resolution.