WordPress : traversée de répertoires

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   wp core version
   wp plugin list --format=table

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour WordPress ou l'extension concernée sur chaque site, après sauvegarde.

   wp core update && wp core update-db
   wp plugin update <extension>
   wp theme update <theme>

3. En attendant le correctif

   Désactiver l'extension concernée (wp plugin deactivate <extension>) si aucune version corrigée n'existe encore.

   Activer une règle de pare-feu applicatif (Wordfence, Cloudflare) pour cette faille si elle est publiée.

4. Contrôler

   wp core version et wp plugin list doivent afficher les versions corrigées.

   Rechercher des comptes administrateurs ou des fichiers PHP créés récemment (wp user list --role=administrator).

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

This security and maintenance release features 17 bug fixes on Core , 19 bug fixes for the Block Editor , and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org , or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically. WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December. For more information, please visit the WordPress 7.1.1 HelpHub site . Security updates included in this release The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release: - Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.). - HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team. - Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team. - Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai . - Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil . - Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic. - XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css , reported by Ben Bidner of the WordPress Security Team. - Contributor+ Arbitrary Post Overwrite, reported by Anthropic. - Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec . - Missing Authorization leads to…