WordPress : traversée de répertoires

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   wp core version
   wp plugin list --format=table

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour WordPress ou l'extension concernée sur chaque site, après sauvegarde.

   wp core update && wp core update-db
   wp plugin update <extension>
   wp theme update <theme>

3. En attendant le correctif

   Désactiver l'extension concernée (wp plugin deactivate <extension>) si aucune version corrigée n'existe encore.

   Activer une règle de pare-feu applicatif (Wordfence, Cloudflare) pour cette faille si elle est publiée.

4. Contrôler

   wp core version et wp plugin list doivent afficher les versions corrigées.

   Rechercher des comptes administrateurs ou des fichiers PHP créés récemment (wp user list --role=administrator).

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

WordPress 6.9.2 is now available This is a security release that features several fixes. Because this is a security release, it is recommended that you update your sites immediately . You can download WordPress 6.9.2 from WordPress.org , or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically. For more information on WordPress 6.9.2, please visit the version page on the HelpHub site . Security updates included in this release The security team would like to thank the following people for responsibly reporting vulnerabilities , and allowing them to be fixed in this release: - A Blind SSRF issue reported by sibwtf , and subsequently by several other researchers while the fix was being worked on - A PoP-chain weakness in the HTML API and Block Registry reported by Phat RiO - A regex DoS weakness in numeric character references reported by Dennis Snell of the WordPress Security Team - A stored XSS in nav menus reported by Phill Savage - An AJAX query-attachments authorization bypass reported by Vitaly Simonovich - A stored XSS via the data-wp-bind directive reported by kaminuma - An XSS that allows overridding client-side templates in the admin area reported by Asaf Mozes - A PclZip path traversal issue reported independently by Francesco Carlucci and kaminuma - An authorization bypass on the Notes feature reported by kaminuma - An XXE in the external getID3 library reported by Youssef Achtatal The WordPress security team have worked with the maintainer of the external getID3 library, James Heinrich, to coordinate a fix to getID3. A new version of getID3 is available here . As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported . The backports are in progress…