WordPress : injection SQL

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   wp core version
   wp plugin list --format=table

2. Corriger

   Versions corrigées : voir l'avis de l'éditeur (lien dans les sources).

   Mettre à jour WordPress ou l'extension concernée sur chaque site, après sauvegarde.

   wp core update && wp core update-db
   wp plugin update <extension>
   wp theme update <theme>

3. En attendant le correctif

   Désactiver l'extension concernée (wp plugin deactivate <extension>) si aucune version corrigée n'existe encore.

   Activer une règle de pare-feu applicatif (Wordfence, Cloudflare) pour cette faille si elle est publiée.

4. Contrôler

   wp core version et wp plugin list doivent afficher les versions corrigées.

   Rechercher des comptes administrateurs ou des fichiers PHP créés récemment (wp user list --role=administrator).

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

This security and maintenance release features 7 security fixes and 4 bug fixes . Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org , or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically. Security updates included in this release The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release: - A stored XSS on the Comments administration page, exploitable via pending comments, reported by Trail of Bits in collaboration with OpenAI. - A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic - A second-Order SQL injection in WordPress WXR export, reported by Anthropic - A weakness allowing Author role users to sticky posts, reported by Anthropic - Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack - Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu , Jingcheng Yang , and Gavin Zhong - Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team Thank you to these WordPress contributors This release was led by Jake Spurlock . WordPress 7.1.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community. Aaron Jorbin , Adam Silverstein , Adi Moldovan , Adrian Duffell , Alex Concha , Arkaprabha Chowdhury , Deepak Kumar , donniam , Ehtisham Siddiqui , Jake Spurlock , Jb Audras , Jeremy Felt , Joe Dolson , John Blackbourn , Jon Surrell , Jonathan Desrosiers , Ken Gagne ,…