Ngamhla tingu-22 Septemba 2026, kusihlwa ngaphambi kwelikhefu leLilanga Lavelonkhe, i-WordPress yakhipha sibuyekezo sekuvikeleka 7.1.2 kuze ivale i-CVE-2026-87902. Lobutsakatsaka abukho ku-plugin nome kuthimu. Bukhona emongweni we-WordPress, futsi butsintsa yonkhe inguculo kusukela ku-4.7.0 kuya ku-7.1.1. Ngalelo langa, nga-11:49 UTC (nga-2:49 ntsambama ngesikhatsi saseRiyadh), inkampani yekuvikeleka i-Patchstack yabona umzamo wekucala wekubusebentisa, kwatsi ngemuva kwemahora langaphansi kwalamane yabona umzamo wekucala wekubhala lifayela eseveni yewebhusayithi.

Kutsi kuhlasela kwasakateka njani emalangeni lasihlanu

Ngemuva kwaloko kwasakateka. Ngekusho kwembiko we-CrowdSec loshicilelwe lamuhla, ngamhla tingu-28 Septemba, inethiwekhi yayo yabhalisa timphawu tekuhlasela letingu-322,680 letihambisana nalobutsakatsaka letivela emakhelini e-IP lehlukene langu-30,813 emkhatsini wamhla tingu-23 nangamhla tingu-27 Septemba, kwefika etulu kakhulu ngamhla tingu-27 Septemba ngetimphawu letingu-124,154. Sigungu Savelonkhe Sekuvikeleka Kwe-inthanethi (NCA) saseSaudi Arabia sakhipha secwayiso Lesibucayi, inombolo 2026-7873, ngamhla tingu-23 Septemba, futsi i-ejensi yaseMelika i-CISA yangenisa lobutsakatsaka ohlwini lwayo lwebutsakatsaka lobatiwako kutsi buyasetjentiswa ngamhla tingu-25 Septemba.

Lokwentiwa butsakatsaka, ngemagama lalula

Nangabe sivakashi sicela likhasi, i-WordPress inquma kutsi ngumuphi lifayela lesifanekiso sethimu lezosetjentiswa kulikhombisa. Liphutsa likulesinyatselo: umhlaseli longakangeni angasiyalela kulifayela le-PHP lelikuseva ngaphandle kwefolda yethimu, futsi i-WordPress italisebentisa. I-WordPress ilinganisa lobutsakatsaka nga-9.2 kulokungu-10; i-CISA ibulinganisa nga-8.1.

Buphendvuka kulawula iwebhusayithi nangabe timo letishiwo esatisweni se-WordPress nasemibikweni yebacwaningi tihlangana:

  • Ithimu: ithimu lesebentako inefolda lelinemagama laca nga-page-. Satiso sibala i-Twenty Twelve, i-Twenty Fourteen, i-Neve, i-Hestia ne-Sydney emkhatsini wetithimu letinalo.
  • Silungiselelo se-PHP: i-register_argc_argv ivuliwe, lokutsi ngekusho kwe-CrowdSec kusimo lesisetjentiswa ngalokwejwayelekile kuma-image e-PHP Docker lasemtsetfweni nakumaseva e-cPanel lasebentisa i-PHP lendzala kune-8.5.
  • Lifayela lelisitako: i-pearcmd.php ye-PEAR ikhona eseveni. Bahlaseli bayayisebentisa kubhala emafayela lamasha e-PHP, ngamanye emagama umnyango wangemuva losindza nangemuva kwesibuyekezo.

Ngako lobutsakatsaka abutsintsi onkhe emawebhusayithi ngendlela lefanako, kodvwa i-Security Affairs ikufingqa ngalendlela: kusebentisa ikhodi kudzinga kutsi kuhlelwa kweseva kuhambisane, futsi emaseva lamanyenti ayahambisana. Umnikati webhizinisi ngalokuvamile akati kutsi ngiyiphi ithimu lesebentako nome kutsi iseva ihlelwe njani, ngako kucabanga lokuphephile kutsi iwebhusayithi isengotini kuze kube kufakazelwa lokuphambene naloko.

Kungani kuhlasela kweta ngemahora, hhayi ngemaviki

Sibuyekezo sekuvikeleka ngekwemvelo yaso siveta kutsi liphutsa likuphi, ngobe lushintjo lwekhodi lusegcekeni. I-Patchstack itsi tintfo tekuhlasela tekucala betihambisana ncamashi naleliphethini lelivalwe kulungiswa, lokusho kutsi nobe ngubani lowatibhala wacala ekulungisweni uqobo, hhayi ekutfoleni kwakhe ngekwakhe. Imizamo yekucala yacela emafayela ejwayelekile emongo we-WordPress, njenge-wp-login.php ne-wp-cron.php, kuze ibone kutsi emawebhusayithi aphendvula njani, yase iya ekubhaleni emafayela.

Lokuhamba kwedatha kuphindze kube netimphawu temashini letiskena ngekutentekela kanye nekhodi ye-proof-of-concept leshicilelwe. Kumnikati webhizinisi, loku kusho kutsi kute lokhetsa iwebhusayithi yakho ngalokukhetsekile. Lamathulusi ahlola yonkhe iwebhusayithi ye-WordPress langayifinyelela, futsi umehluko emkhatsini wewebhusayithi lengenwe bahlaseli naleyo lehlobile kutsi sibuyekezo safika yini ngaphambi kwawo.

Iwebhusayithi yakho iyatibuyekeza yini ngekwayo?

Kungenteka, kodvwa ungacabangi kutsi kunjalo. I-WordPress ibe netibuyekezo letitentekelako ngemuva kusukela enguculweni 3.7, futsi kusukela ku-5.6 kufakwa lokusha kubuyekeza ngekutentekela tinguculo letincane naletinkhulu. Simemetelo se-7.1.2 sitsi emawebhusayithi lasekela tibuyekezo letitentekelako ngemuva atawucala kutibuyekeza ngekwawo.

Kodvwa tibuyekezo letitentekelako tingavalwa ngemugca munye ku-wp-config.php. Labanye batfutfukisi bayativala ngemabomu kuze sibuyekezo singayoni ithimu leshintjwe yafaneliswa, futsi letinye tinkampani tekusingatsa tilawula tibuyekezo ngasohlangotsini lwato. Iwebhusayithi leyakhiwa ngumuntfu losebenta ngekutimela eminyakeni leyendlula, lenkontileka yakhe seyaphela, ingahlala enguculweni lendzala kungekho loboni. Kuze uhlole:

  • Ngena engxenyeni yekulawula yewebhusayithi, uvule likhasi lelitsi Updates ngaphansi kwemenyu lelitsi Dashboard, futsi utawubona khona inguculo yamanje.
  • Inguculo lephephile ngu-7.1.2 nome lesemuva kwayo. Nangabe iwebhusayithi yakho isegatjeni lelidzala, kulungiswa kwefika kuwo onkhe emagatja kuya emuva ku-4.7, kufaka ekhatsi i-7.0.6, 6.9.9, 6.8.10 ne-4.7.37; luhlu lolugcwele lusesatisweni se-WordPress lesixhunyaniswe emitfonjeni.
  • Naka kutsi i-WordPress itsi yinguculo yakamuva kuphela lesekelwa ngalokusebentako. Iwebhusayithi leshiywe egatjeni lelidzala yakutfola lokulungiswa, kodvwa iphila ngesikhatsi lesibolekiwe. Sachaza kutsi inguculo lensha iletsani kuwebhusayithi yenkampani ku-WordPress 7.1: tintfo letinsha letibalulekile.

Ne-Elementor: sixhumanisi sinye siyenela

Ngaleliviki lelifanako, i-Elementor, sakhi semakhasi se-WordPress lesidvumile, yalungisa butsakatsaka lobukhona kuphela etinguculweni 4.3.0 na-4.3.1. Nangabe umlawuli wewebhusayithi avula sixhumanisi lesentiwe ngemachinga asangenile, umhlaseli angakha i-akhawunti yemlawuli layilawulako, futsi lesixhumanisi singefika nge-imeyili, ngengcoco nome ngekuphawula. Ngekusho kwe-BleepingComputer, letinguculo tisebenta kumawebhusayithi lafika etigidzini letingu-2. Kulungiswa kwaphuma ku-4.3.2 ngamhla tingu-24 Septemba, futsi lewebhusayithi ayizange ibike kusetjentiswa lokusebentako kwebutsakatsaka ngesikhatsi ishicilela.

Ciniseka kutsi i-Elementor ikunguculo 4.3.2 nome lesemuva kwayo, futsi ukwente kube ngumtsetfo welicembu: ningavuli tixhumanisi letivela emilayetweni nome ekuphawuleni nisangenile engxenyeni yekulawula yewebhusayithi.

Nangabe iwebhusayithi yakho ingakabuyekezwa kusukela ngamhla tingu-22 Septemba

  • Yibuyekeze nyalo: nangabe umtfutfukisi esaba kutsi sibuyekezo sitawona lokutsite, i-Patchstack itsi lendlela ingavalwa okwesikhashana ngekuvimba imizamo ye-directory traversal kupharamitha ye-pagename, nome ngekuvala i-register_argc_argv. Lowo ngumsebenti wenkampani yekusingatsa nome wemtfutfukisi, futsi awusitsatseli indzawo sibuyekezo.
  • Cabanga kutsi iwebhusayithi yakho seyihlolwe bahlaseli: cela umtfutfukisi nome inkampani yekusingatsa kutsi bafune emafayela e-PHP lakute muntfu lowawafaka, ikakhulukati ku-/tmp naku-/var/tmp, lapho i-Patchstack ibala emafayela lanjenge-poc87902.php ne-wp-pear-rce-flag.php njengetimphawu tekusebentisa ikhodi lokuphumelele.
  • Nangabe kutfolakala lokutsite: kuphatse njengesehlakalo, hhayi njengesibuyekezo. Shintja emaphasiwedi ema-akhawunti ebalawuli, edathabheyisi kanye nekusingatsa, ubuyisele iwebhusayithi usebentisa ikhophi yekulondvolota lehlobile, bese uyibuyekeza.
  • Nangabe iwebhusayithi igcina imininingwane yemakhasimende: lokusho kutsi igcina ema-oda, emafomu ekuxhumana nome ema-akhawunti, umhlahlandlela weSigungu SaseSaudi Sedatha Nekuhlakanipha Kwekwakhiwa (SDAIA) mayelana netehlakalo tekwephulwa kwemininingwane yemuntfu udzinga kutsi umlawuli wemininingwane atise sigungu lesifanele kungakapheli emahora langu-72 kusukela ati ngekwephulwa lokungalimata imininingwane nome bantfu labangabanikati bayo.

Umbono we-Origami

Emawebhusayithi lamanyenti etinkampani akhiwa nge-WordPress bese ayaphatfwa njengelibhukwana leliphrintiwe: umtfutfukisi uyayinikela, umnikati uyakhokha, futsi kute lobuta kutsi ngubani lotawuyigcina ibuyekeziwe. Lobutsakatsaka busikhumbuta kutsi iwebhusayithi luhlelo loluphilako eseveni levulekele i-inthanethi, nekutsi sikhatsi lesisemkhatsini wekushicilelwa kwekulungiswa nekufika kwemhlaseli manje silinganiswa ngemahora. Umbuto wangempela akusiko kutsi i-WordPress iphephile yini, ngobe yalilungisa liphutsa futsi yatfumela kulungiswa kuwo onkhe emagatja kuya emuva ku-4.7. Umbuto kutsi ngubani enkampanini yakho lonesibopho sekukufaka.

Kungako sicabanga kutsi inkontileka yekunakekela iwebhusayithi kufanele ibeke sikhatsi lesiphakeme sekufaka tibuyekezo tekuvikeleka letibucayi, idzinge ikhophi ye-staging lapho tibuyekezo tihlolwa khona ngaphambi kwewebhusayithi lesebentako, futsi igcine emakhophi ekulondvolota lajwayelekile lagcinwe ngaphandle kweseva uqobo. Futsi nangabe tibuyekezo tichubeka tibambezelwa ngobe ithimu ishintjwe ngendlela leyoneka ngaso sonkhe sibuyekezo, leyo yinkinga yendlela iwebhusayithi leyakhiwa ngayo, hhayi ye-WordPress, futsi kufanele ilungiswe ngaphambi kwebutsakatsaka lobulandzelako.

Sigcino: tinyatselo letintsatfu

  • Lamuhla: vula ingxenye yekulawula bese uciniseka kutsi inguculo ngu-7.1.2 nome inguculo lelungisiwe yeligatja lakho, nekutsi i-Elementor ikunguculo 4.3.2 nome lesemuva kwayo.
  • Leliviki: cela umtfutfukisi nome inkampani yekusingatsa kutsi iskene iseva ifune emafayela e-PHP langatiwa futsi iciniseke ngekubhala kutsi tibuyekezo letitentekelako tivuliwe.
  • Lenyanga: engeta enkontilekeni yekunakekela sikhatsi lesiphakeme sekufaka tibuyekezo tekuvikeleka, bese ubiza ngelibito umuntfu lonesibopho saloko.

Imitfombo