Template resolution is the logic a web application uses to decide which template file should render a page. In systems like WordPress, it may inspect the request, page type, and theme layout to pick a file from the active theme or core directories. This process matters because it sits at the boundary between user-controlled input and server-side file access. If the resolution rules are too permissive, an attacker may steer the application toward an unintended local file.
In security incidents, template resolution bugs can become path traversal or local file inclusion issues. If the chosen file is a PHP script and the application includes it, the server may execute that code instead of simply displaying it. Defenders reduce risk by validating paths, using allowlists for template names, canonicalizing filesystem paths, and restricting web server access to sensitive files. Keeping the framework and themes patched is also critical, because a small flaw in template lookup can become remote code execution.