WordPress : exécution de code à distance

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   wp core version
   wp plugin list --format=table

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour WordPress ou l'extension concernée sur chaque site, après sauvegarde.

   wp core update && wp core update-db
   wp plugin update <extension>
   wp theme update <theme>

3. En attendant le correctif

   Désactiver l'extension concernée (wp plugin deactivate <extension>) si aucune version corrigée n'existe encore.

   Activer une règle de pare-feu applicatif (Wordfence, Cloudflare) pour cette faille si elle est publiée.

4. Contrôler

   wp core version et wp plugin list doivent afficher les versions corrigées.

   Rechercher des comptes administrateurs ou des fichiers PHP créés récemment (wp user list --role=administrator).

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading it from WordPress.org , or visiting your site’s Dashboard → Updates and clicking Update Now . Sites that support automatic background updates will begin updating shortly. For more information, please visit the WordPress 7.0.3 HelpHub site . Security updates included in this release The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release: - Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai . - Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes ( amosec ) - Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by N05ec@LZU - Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal - Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team - A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security - An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team - Enumeration of post slugs reported by HDWSec - Disclosure of notes in comment feeds reported by Elio Gubser - Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic - Bypass of the email address confirmation flow reported by Omar Hasan - A server-side request forgery (SSRF) issue in URL validation allowing…