ʻO ka nāwaliwali o WordPress CVE-2026-119977: Nā Pūnaewele i Hacked i ka wā o nā Hoʻohou a pehea e pale ai i kāu

I ka hopena o ʻOkakopa 2026, ua loaʻa kahi nāwaliwali i loko o ka ʻōnaehana hoʻohou WordPress: CVE-2026-119977 . Hāʻawi ia i kahi mea hoʻouka me ka ʻole o ka inoa inoa a i ʻole ka ʻōlelo huna e hoʻokō i ke code kūpono ʻole ma ke kikowaena - akā ʻoiai e hoʻohou ana ka pūnaewele. Ke hoʻohana mua ʻia nei ka nāwaliwali i nā hoʻouka maoli.

Aia ma lalo iho nei pehea e hana ai, ʻo wai ka mea i hoʻopilikia ʻia a me nā mea e hana ai e pale i kāu pūnaewele.

ʻO ka nāwaliwali i ka pōkole

• He aha kēia: he kūlana heihei (papa TOCTOU) i ke kaʻina hana hoʻohou piha o WordPress.
• Kaumaha: CVSS 8.1 (Kiʻekiʻe).
• Nā mana i hoʻopilikia ʻia: ʻO WordPress 4.7 a hiki i ka 7.1.3 e komo pū ana.
• Nā mea e pono ai ka mea hoʻouka: ʻO ke komo HTTP wale nō i ka pūnaewele. ʻAʻohe hōʻoia a ʻaʻohe hana a ka luna hoʻomalu e pono ai.
• Hoʻohana: ma Nowemapa 3, 2026, ua hoʻohui ʻo CISA i ka nāwaliwali i kāna papa inoa ʻo Known Exploited Vulnerabilities (KEV). Ua hoʻopaʻa ʻo Wordfence ma mua o 18,500 mau noi i nā ala nāwaliwali i nā hola 21 mua ma hope o ka hōʻike ʻia ʻana o nā kikoʻī.

Pehea e hana ai ka hoʻouka kaua

I ka wā o kahi hoʻonui piha piha, hana ʻo WordPress i kēia mau mea:

1. Hoʻoiho i ka waihona me ka mana hou.
2. Hoʻopuka iā ia i kahi waihona manawa pōkole i loko wp-content/upgrade/.
3. Kope i nā faila ma luna o ka pūnaewele ola.
4. Holoi i ka waihona manawa pōkole.

ʻO ka pilikia, aia ka waihona manawa pōkole ma kahi ala wānana a hiki ke hoʻopili ʻia mai kahi polokalamu kele pūnaeweleAia i loko he kope piha o WordPress, me ka setup-config.php hoʻonohonoho.

ʻOiai e holo ana ka mea hou, hiki i ka mea hoʻouka ke wehe i kēia mea hoʻonoho a hele ma waena. ʻO ka hopena, hiki iā lākou ke pani i ka mea ola wp-config.php a kuhikuhi i ka pūnaewele i kā lākou waihona ʻikepili hakahaka ponoʻī. A laila hāʻawi ʻo WordPress i kahi "hoʻonohonoho" - hoʻopau ka mea hoʻouka iā ia, lilo i luna hoʻomalu a holo i kā lākou code PHP ponoʻī ma ke kikowaena.

ʻO ka puka makani hoʻouka kaua nā kekona liʻiliʻi e lawe ai i ka hoʻopou hou ʻana. ʻO ia ka mea e paʻakikī ai ka hoʻouka kaua ʻana i ka hana maʻamau, akā nānā mau nā scanners nui i nā ala palupalu, e hilinaʻi ana i kēlā manawa e kū pono ai.

Hoʻololi ka mana 7.1.4 i ka inoa waihona manawa pōkole, hoʻohui i ka pale mai ke komo pololei a ālai i ka hoʻonohonoho ʻana mai ka lawe ʻia ʻana mai ke kope manawa pōkole.

'alemanaka

Nā mana paʻa

Ua hoʻihoʻi ʻia ka hoʻoponopono i kēlā me kēia lālā i kākoʻo ʻia a hiki i ka 4.7. Paipai mākou e hoʻopou hou i ka mana hou loa, 7.1.4.

ʻAʻole i loaʻa kahi hoʻoponopono i nā mana 4.6 a ʻoi aku. Pono e hōʻano hou ʻia kēia mau pūnaewele i kahi mana o kēia manawa a i ʻole e hoʻopau ʻia ka lawelawe.

KaʻAnuʻu Hana 1. E nānā i kāu mana WordPress

Ma ka papa hoʻomalu: Dashboard → Nā Hoʻohou . Mai hilinaʻi i nā hoʻohou aunoa - ʻaʻole paha lākou i holo: hiki ke hoʻopau ʻia, hāʻule ma muli o nā ʻae faila a i ʻole e pani ʻia e kahi plugin.

Me WP-CLI:

wp core version

Inā he nui kāu mau pūnaewele ma ke kikowaena, hiki iā ʻoe ke loaʻa i kēlā me kēia hoʻonohonoho WordPress a me kona mana e like me kēia:

find /var/www -path '*/wp-includes/version.php' -exec grep -H "wp_version =" {} \;

e puku i /var/www me ka papa kuhikuhi kahi e noho ai kāu mau pūnaewele.

KaʻAnuʻu Hana 2. E ālai i ke komo ʻana i ka wp-content/upgrade/ (no VPS a me nā kikowaena i hoʻolaʻa ʻia)

ʻO kēia ke ana koʻikoʻi loa. Pani ia i ka puka makani hoʻouka me ka nānā ʻole i kāu mana WordPress a ʻaʻole ia e hoʻopilikia i nā mea hou: Hana ʻo WordPress me kēia waihona ma o ka ʻōnaehana faila, ʻaʻole ma ka pūnaewele. E hana i kēia ma mua o ka hoʻonui ʻana, ʻoiai ke hana pololei nei ka hoʻouka ʻana i ka wā o ka hoʻonui ʻana.

nginx

E hoʻohui i kēia i kāu pūnaewele server poloka:

location ^~ /wp-content/upgrade/ {
    deny all;
}

E hoʻāʻo i ka hoʻonohonoho a hoʻouka hou i ka nginx:

nginx -t && systemctl reload nginx

ʻApache a me LiteSpeed

Hoʻohui i kēia i ka .htaccess faila ma ke aʻa pūnaewele, luna ka ʻenehana # BEGIN WordPress poloka:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-content/upgrade/ - [F,L]
</IfModule>

Inā loaʻa iā ʻoe ke komo i ka hoʻonohonoho kikowaena virtual Apache, ʻoi aku ka hilinaʻi e ālai i ka papa kuhikuhi ma laila:

<Directory "/var/www/example.com/wp-content/upgrade">
    Require all denied
</Directory>

E hoʻololi i ke ala me kāu iho a hoʻouka hou iā Apache:

apachectl configtest && systemctl reload apache2

Ma AlmaLinux, Rocky a me nā ʻōnaehana ʻē aʻe e pili ana iā RHEL, ua kapa ʻia ka lawelawe httpd.

E nānā i ka hana ʻana o ka poloka

curl -I https://example.com/wp-content/upgrade/

Pono ka pane e hoʻihoʻi i ke code 403.

KaʻAnuʻu Hana 3. E hana i kahi kope kope

Ma mua o ka hoʻonui ʻana, e kākoʻo i nā faila pūnaewele a me ka waihona ʻikepili. Me WP-CLI:

wp db export ~/backup-$(date +%F).sql
tar -czf ~/site-files-$(date +%F).tar.gz -C /var/www/example.com .

Inā loaʻa iā ʻoe kahi VPS, hiki iā ʻoe ke lawe i kahi kiʻi paʻi kiʻi kikowaena ma ka papa mana.

KaʻAnuʻu Hana 4. Hoʻohou i ka WordPress

Ma o ka papa hoʻomalu a i ʻole WP-CLI

Inā ua ālai ʻoe i ke komo ʻana i wp-content/upgrade/ (KaʻAnuʻu Hana 2), hōʻano hou e like me ka mea maʻamau - mai ka panela admin a i ʻole me WP-CLI:

wp core update
wp core update-db
wp core version

Pono ke kauoha hope loa e hōʻike i ka 7.1.4 a i ʻole ka mana paʻa no kāu lālā.

Ma ka lima, me ka ʻole o ka puka makani hoʻouka

Inā ʻaʻole hiki iā ʻoe ke ālai i ke komo ʻana i ka papa kuhikuhi ma ka pae kikowaena pūnaewele (no ka laʻana, ʻaʻohe ou komo i kāna hoʻonohonoho ʻana), ʻoi aku ka palekana o ka hoʻohou lima ʻana. Hoʻopuka ʻia ka waihona ma waho o ke kumu o ke kahua, a kope ʻia nā faila me ka ʻole o ka hoʻopā ʻana. wp-config.php or wp-content:

cd /tmp
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
rsync -a --exclude 'wp-content' --exclude 'wp-config.php' /tmp/wordpress/ /var/www/example.com/
rm -rf /tmp/wordpress /tmp/latest.tar.gz

A laila e hoʻihoʻi i ka kuleana o ka faila (ʻokoʻa paha ka mea hoʻohana kikowaena pūnaewele, no ka laʻana nginx or apache) a hōʻano hou i ka waihona ʻikepili:

chown -R www-data:www-data /var/www/example.com
wp core update-db

Ma kahi o ke kauoha hope loa, hiki iā ʻoe ke wehe https://example.com/wp-admin/upgrade.php i kāu polokalamu kele pūnaewele.

Mai poina i nā plugins a me nā kumumanaʻo

wp plugin update --all
wp theme update --all

KaʻAnuʻu Hana 5. E nānā i kāu pūnaewele no nā hōʻailona o ka hoʻopilikia ʻana

Inā ua hōʻano hou ʻia kāu pūnaewele mai kahi mana palupalu ma hope o ʻOkakopa 28, e hōʻoia ʻaʻohe mea i hoʻohana i ka hoʻouka kaua ʻana.

Nā noi i nā mea hoʻonoho manawa pōkole ma nā log:

# nginx
grep -E "wp-content/upgrade/.*\.php" /var/log/nginx/access.log*

# Apache
grep -E "wp-content/upgrade/.*\.php" /var/log/apache2/access.log*

Nā noi me kahi 200 he mea kānalua loa ke code pane.

ʻO kahi wp-config.php i pani ʻia: e nānā i ka lā hoʻololi o ka faila a me nā hoʻonohonoho pili waihona ʻikepili.

ls -l /var/www/example.com/wp-config.php
grep -E "DB_(NAME|USER|HOST)" /var/www/example.com/wp-config.php

Ka pono o ka faila koʻikoʻi:

wp core verify-checksums

Nā faila PHP a me nā luna hoʻomalu i ʻike ʻole ʻia:

find /var/www/example.com/wp-content/upgrade /var/www/example.com/wp-content/uploads -name "*.php"
find /var/www/example.com -name "*.php" -mtime -10
wp user list --role=administrator

Inā loaʻa iā ʻoe kahi mea i pani ʻia wp-config.php, nā luna hoʻomalu i ʻike ʻole ʻia a i ʻole nā ​​faila PHP i manaʻo ʻole ʻia, e mālama i ka pūnaewele e like me ka mea i hoʻopilikia ʻia. E hoʻihoʻi iā ia mai kahi kope i hana ʻia ma mua o ʻOkakopa 28, e hoʻohou iā WordPress a hoʻololi i nā ʻōlelo huna āpau: luna hoʻomalu, waihona ʻikepili, FTP a me SSH.

Inā mālama kahi mea hana i kāu pūnaewele

E hoʻouna i kēia ʻatikala iā lākou a noi iā lākou e hōʻoia ua hōʻano hou ʻia ka pūnaewele i kahi mana paʻa a ua nānā ʻia no nā hōʻailona o ka hoʻopilikia ʻana.

Kōkua i kōkua?

ʻAʻole maopopo iā ʻoe hiki iā ʻoe ke lawelawe i kēia iā ʻoe iho, a i ʻole ua loaʻa iā ʻoe nā faila kānalua? E kelepona i kā mākou hui kākoʻo - e kōkua mākou iā ʻoe e hoʻoponopono iā ia.