WordPress : exécution de code à distance

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   wp core version
   wp plugin list --format=table

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour WordPress ou l'extension concernée sur chaque site, après sauvegarde.

   wp core update && wp core update-db
   wp plugin update <extension>
   wp theme update <theme>

3. En attendant le correctif

   Désactiver l'extension concernée (wp plugin deactivate <extension>) si aucune version corrigée n'existe encore.

   Activer une règle de pare-feu applicatif (Wordfence, Cloudflare) pour cette faille si elle est publiée.

4. Contrôler

   wp core version et wp plugin list doivent afficher les versions corrigées.

   Rechercher des comptes administrateurs ou des fichiers PHP créés récemment (wp user list --role=administrator).

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org , or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically. Security update included in this release The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE). Thank you to these WordPress contributors This release was led by John Blackbourn . WordPress 7.1.2 would not have been possible without the contributions of the following people: Aaron Jorbin , Aki Hamano , Alex Concha , Ehtisham Siddiqui , fiocavallari , Jb Audras , Jeffrey Paul , Jeremy Felt , Joe McGill , John Blackbourn , Jon Surrell , Lance Willett , Manuel Camargo , marcs0h , martin.krcho , Mukesh Panchal , Olga Gleckler , Pascal Birchler , Peter Wilson , Rajin Sharwar , Ressl , Rudy Faile , Sergey Biryukov , Shail Mehta , Stephanie Walters , and vortfu . CVE and GHSA references Further details can be found in the advisory: CVE-2026-87902 / GHSA-7hp8-65ch-5whp . Backports As a courtesy, the security fix was backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported .