Nuglaanta WordPress CVE-2026-119977: Goobaha la jabsaday inta lagu jiro Cusboonaysiinta iyo Sida loo Ilaaliyo Taada

Dhammaadkii Oktoobar 2026, waxaa laga helay nuglaansho habka cusboonaysiinta WordPress: CVE-2026-119977 . Waxay u oggolaanaysaa weeraryahan aan lahayn gal ama erayga sirta ah inuu ku fuliyo kood aan kala sooc lahayn server-ka - laakiin kaliya inta goobta la cusbooneysiinayo. Nuglaanshuhu horey ayaa loogu isticmaalayaa weerarrada dhabta ah.

Hoos waxaa ku qoran sida ay u shaqeyso, cidda ay saameysay iyo waxa la sameeyo si aad u ilaaliso boggaaga.

Nuglaanta oo kooban

• Waa maxay: xaalad tartan (fasalka TOCTOU) oo ku jirta habka cusboonaysiinta asaasiga ah ee WordPress oo dhammaystiran.
• Darnaanta: CVSS 8.1 (Sare).
• Noocyada ay saameysay: WordPress 4.7 ilaa 7.1.3 oo ay ku jiraan.
• Waxa uu weeraryahanku u baahan yahay: kaliya marin u helidda HTTP ee goobta. Looma baahna xaqiijin iyo ficil maamule.
• Ka faa'iidaysiga: Noofambar 3, 2026, CISA waxay nuglaanta ku dartay buug-yaraha Known Exploited Vulnerabilities (KEV). Wordfence waxay diiwaangelisay in ka badan 18,500 oo codsi oo ku saabsan waddooyinka nugul 21-kii saacadood ee ugu horreeyay ka dib markii faahfaahinta la shaaciyay.

Sida weerarku u shaqeeyo

Inta lagu jiro cusbooneysiinta aasaasiga ah ee buuxa, WordPress wuxuu sameeyaa waxyaabaha soo socda:

1. Waxay ku soo dejisaa kaydka nooca cusub.
2. Waxay u soo saartaa fayl ku meel gaar ah oo gudaha ku jira wp-content/upgrade/.
3. Faylasha waxay ku koobiyeeysaa bogga tooska ah.
4. Waxay tirtirtaa faylka ku meel gaarka ah.

Dhibaatadu waxay tahay in faylka ku meel gaarka ah uu ku yaal waddo la saadaalin karo iyo waa laga heli karo biraawsarGudaha waxaa ku jira nuqul dhammaystiran oo WordPress ah, oo ay ku jiraan setup-config.php rakibay.

Inta cusbooneysiintu socoto, weeraryahanku wuxuu furi karaa rakibahan oo uu dhex mari karaa. Natiijo ahaan, waxay beddeli karaan tooska ah wp-config.php oo bogga u tilmaam xogtooda madhan. WordPress ayaa markaa bixiya "rakibaad" - qofka weerarka soo qaaday ayaa dhammaystiraya, noqonaya maamule oo ku maamulaya koodkooda PHP ee server-ka.

Daaqadda weerarka waa dhowr ilbiriqsi oo cusbooneysiintu qaadanayso. Taasi waxay ka dhigaysaa weerarka mid adag in la sameeyo marka la fulinayo, laakiin qalabka wax lagu sawiro ee tirada badan ayaa si joogto ah u baara waddooyinka nugul, iyagoo ku tiirsan waqtiga saxda ah ee la safanayo.

Nooca 7.1.4 wuxuu si aan kala sooc lahayn u sameeyaa magaca faylka ku meel gaarka ah, wuxuu ku darayaa ilaalin ka dhan ah gelitaanka tooska ah wuxuuna xannibayaa habaynta in laga qaado nuqulka ku meel gaarka ah.

Jadwalka

Noocyo go'an

Hagaajinta waxaa dib loogu celiyay laan kasta oo la taageeray ilaa 4.7. Waxaan kugula talineynaa inaad cusbooneysiiso nooca ugu dambeeyay, 7.1.4.

Noocyada 4.6 iyo wixii ka horreeyay ma helin wax hagaajin ah. Goobahan waxay u baahan yihiin in lagu cusbooneysiiyo nooca hadda jira ama laga saaro adeegga.

Tallaabada 1. Hubi nooca WordPress-kaaga

Guddiga maamulka: Dashboard → Cusbooneysiinta . Ha ku tiirsanaan cusbooneysiinta otomaatiga ah — waxaa laga yaabaa inaysan shaqeynin: way curyaamin karaan, way ku guuldareysan karaan sababtoo ah rukhsadaha faylka ama waxaa ka hor istaagi kara plugin.

Iyada oo la adeegsanayo WP-CLI:

wp core version

Haddii aad leedahay dhowr bog oo ku jira server-ka, waxaad ka heli kartaa rakibaad kasta oo WordPress ah iyo nooceeda sidan oo kale:

find /var/www -path '*/wp-includes/version.php' -exec grep -H "wp_version =" {} \;

Bedel /var/www oo leh buugga ay ku nool yihiin goobaha aad booqato.

Tallaabada 2. Jooji marin u helidda wp-content/upgrade/ (VPS iyo server-yada gaarka ah)

Kani waa cabbirka ugu muhiimsan. Waxay xirtaa daaqadda weerarka iyadoon loo eegin nooca WordPress-kaaga mana farageliso cusbooneysiinta: WordPress wuxuu la shaqeeyaa faylkan nidaamka faylka, ee ma aha shabakadda. Tan samee ka hor intaadan cusbooneysiin, maadaama weerarku si sax ah u dhaco inta lagu jiro cusbooneysiinta.

nginx

Ku dar tan boggaaga server baloog:

location ^~ /wp-content/upgrade/ {
    deny all;
}

Tijaabi qaabeynta oo dib u soo celi nginx:

nginx -t && systemctl reload nginx

Apache iyo LiteSpeed

Kudar kan .htaccess faylka ku jira asalka goobta, kor ku xusan heerka # BEGIN WordPress baloog:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-content/upgrade/ - [F,L]
</IfModule>

Haddii aad marin u heli karto qaabeynta martigeliyaha dalwaddii ee Apache, way ka kalsooni badan tahay inaad xannibto tusmada halkaas:

<Directory "/var/www/example.com/wp-content/upgrade">
    Require all denied
</Directory>

Ku beddel waddada adiga kuu gaar ah oo dib u soo celi Apache:

apachectl configtest && systemctl reload apache2

Nidaamyada kale ee ku salaysan AlmaLinux, Rocky iyo RHEL, adeegga waxaa loogu yeeraa httpd.

Hubi in balooggu shaqeynayo

curl -I https://example.com/wp-content/upgrade/

Jawaabtu waa inay soo celisaa koodhka 403.

Tallaabada 3. Samee kayd

Kahor intaadan cusbooneysiin, kaydi faylasha goobta iyo xogta. Iyada oo la adeegsanayo WP-CLI:

wp db export ~/backup-$(date +%F).sql
tar -czf ~/site-files-$(date +%F).tar.gz -C /var/www/example.com .

Haddii aad leedahay VPS, waxaad sidoo kale sawir ka qaadi kartaa server-ka guddiga kantaroolka.

Tallaabada 4. Cusboonaysii WordPress

Iyada oo loo marayo guddiga maamulka ama WP-CLI

Haddii aad xannibtay marin u helidda wp-content/upgrade/ (Tallaabada 2), cusbooneysii sidii caadiga ahayd — laga bilaabo guddiga maamulka ama WP-CLI:

wp core update
wp core update-db
wp core version

Amarka ugu dambeeya waa inuu muujiyaa 7.1.4 ama nooca go'an ee laantaada.

Gacanta, iyada oo aan daaqad weerar lahayn

Haddii aadan xannibi karin gelitaanka tusmada heerka server-ka shabakadda (tusaale ahaan, ma heli kartid habaynteeda), way ka ammaan badan tahay inaad gacanta ku cusboonaysiiso. Kaydka waxaa laga soo saaraa meel ka baxsan xididka goobta, faylashana waa la koobiyeeyaa iyada oo aan la taaban. wp-config.php or wp-content:

cd /tmp
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
rsync -a --exclude 'wp-content' --exclude 'wp-config.php' /tmp/wordpress/ /var/www/example.com/
rm -rf /tmp/wordpress /tmp/latest.tar.gz

Kadib soo celi lahaanshaha faylka (isticmaalaha server-ka shabakadu wuu kala duwanaan karaa, tusaale ahaan nginx or apache) oo cusbooneysii xogta:

chown -R www-data:www-data /var/www/example.com
wp core update-db

Halkii aad ka isticmaali lahayd amarka ugu dambeeya, waad furi kartaa https://example.com/wp-admin/upgrade.php shabakadaada.

Ha ilaawin plugins-ka iyo mawduucyada

wp plugin update --all
wp theme update --all

Tallaabada 5. Ka hubi boggaaga calaamadaha tanaasulka

Haddii boggaaga laga cusbooneysiiyay nooc nugul ka dib Oktoobar 28, hubi in cidna aysan ka faa'iideysan weerarka.

Codsiyada loo dirayo rakibayaasha ku meel gaarka ah ee diiwaanka:

# nginx
grep -E "wp-content/upgrade/.*\.php" /var/log/nginx/access.log*

# Apache
grep -E "wp-content/upgrade/.*\.php" /var/log/apache2/access.log*

Codsiyada leh a 200 Koodhka jawaabta ayaa si gaar ah looga shakisan yahay.

wp-config.php oo la beddelay: hubi taariikhda wax ka beddelka faylka iyo dejimaha isku xirka xogta.

ls -l /var/www/example.com/wp-config.php
grep -E "DB_(NAME|USER|HOST)" /var/www/example.com/wp-config.php

Daacadnimada faylka aasaasiga ah:

wp core verify-checksums

Faylasha iyo maamulayaasha PHP ee aan la aqoon:

find /var/www/example.com/wp-content/upgrade /var/www/example.com/wp-content/uploads -name "*.php"
find /var/www/example.com -name "*.php" -mtime -10
wp user list --role=administrator

Haddii aad hesho beddelaad wp-config.php, maamulayaal aan la aqoon ama faylasha PHP ee aan la filayn, ula dhaqan bogga sidii mid la jabsaday. Ka soo celi kayd kayd ah oo la sameeyay ka hor Oktoobar 28, cusbooneysii WordPress oo beddel dhammaan furayaasha sirta ah: maamulaha, kaydka xogta, FTP iyo SSH.

Haddii qandaraasle uu ilaaliyo goobtaada

Maqaalkan u gudbi oo weydii inay xaqiijiyaan in bogga la cusbooneysiiyay nooc go'an oo la hubiyay calaamado muujinaya tanaasul.

Ma ubaahantahay caawimo?

Ma hubtid inaad adigu tan maareyn karto, mise waxaad heshay faylal laga shakiyo? La xiriir kooxdayada taageerada - waan kaa caawin doonnaa inaad xalliso.