WordPress 爆严重路径遍历漏洞
推荐指数 45.0 NO. 022 · 2026.09.23
发布2026/09/22Score106Comments54
为什么值得看
WordPress 核心存在未认证路径遍历漏洞，攻击者可利用页面模板解析机制实现条件性远程代码执行。影响范围横跨 4.7 到 7.1.1 共 18 个主要版本，全球数百万站点面临被攻陷风险。
编辑判断
这个漏洞的杀伤力在于"未认证"三个字——不需要管理员账号就能触发，且利用链完整（路径遍历→文件包含→RCE）。WordPress 生态长期被低估的安全债正在集中爆发，插件漏洞常见但核心 RCE 极为罕见。
如果你是托管 WordPress 的 SaaS 或做相关安全产品，这是拉新的窗口期：很多站长甚至不知道自己用的 6.x 版本已经停止安全更新。建议立刻检查客户资产版本分布，优先推送 7.1.2/7.0.6/6.9.9 三个补丁版本。
社区反馈
负面 36 条评论
核心争论：WordPress 安全漏洞是代码质量问题还是流行度带来的必然攻击面
pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.
As the article points out, one issue is that the official Docker container for PHP has this configuration. However at least in principle all of the affected versions [0] could be automatically updated. Not sure if they have set it to auto-update as far back as 4.7 though. [0] except 4.9.3 which has
pearcmd and register_argc_argv are just examples. get_page_template was unsanitized in some themes, that's the flaw, you could then combine it with one of a million unauthorized file upload in wordpress plugins to try and eval code. An attacker would like to use upload + this chain of requires (inst