WordPress : vulnérabilité

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   wp core version
   wp plugin list --format=table

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour WordPress ou l'extension concernée sur chaque site, après sauvegarde.

   wp core update && wp core update-db
   wp plugin update <extension>
   wp theme update <theme>

3. En attendant le correctif

   Désactiver l'extension concernée (wp plugin deactivate <extension>) si aucune version corrigée n'existe encore.

   Activer une règle de pare-feu applicatif (Wordfence, Cloudflare) pour cette faille si elle est publiée.

4. Contrôler

   wp core version et wp plugin list doivent afficher les versions corrigées.

   Rechercher des comptes administrateurs ou des fichiers PHP créés récemment (wp user list --role=administrator).

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

WordPress at 23 is simultaneously both the strongest and most precarious it’s ever been. Last week, we shipped WordPress 7 to the world . In seven days, 46% of all WordPresses , tens of millions across countless different hosting environments, are already on 7.0, auto-updated with no breakage. From a Raspberry Pi to the most secure sites in the world, like WhiteHouse.gov . Sit with that for a minute when you think of all the resources and all the projects that have had security problems in the past few weeks. No supply chain attacks, no security problems, just a stable, secure infrastructure doing its job invisibly to power a huge portion of the open internet. I’m really proud of the capability and security of WordPress, and we should celebrate that. That accomplishment represents the work of thousands and thousands of people coming together to make the web a better place. Also, an iceberg of what is going on behind the scenes. However, the release was not what I hoped it would be because so much time from key people was taken away by WP Engine’s attacks. Silver Lake , in its immense 100B+ power, summoned a shoggoth in Quinn Emanuel that has been paperclip-maximizing legal torture that is not just going after Automattic and WordPress.org and me personally, but this Golem Jagannath is now trying to dissolve the WordPress Foundation itself, a non-profit with no employees or payroll that supports WordCamps and Open Source education around the world . If you know anyone at Silver Lake , Quinn Emanuel , or WP Engine in that order, please beg, plead with them to stop the violence. End this internecine warfare that is threatening to destroy one of the last stalwarts of the Open Web. It’s not fun and games anymore, not just business. This is having a real impact on people’s lives. It took every ounce of will in my body, and I am grateful to thousands of hours of meditation, to not explode in rage when asked about pineapple on pizza and debating the meaning of Jean…