WordPress has released an emergency security update to patch a critical vulnerability in its core software that could allow an attacker without any credentials to take control of a website. The flaw, which demands immediate action from site administrators, was disclosed alongside the release of WordPress 7.1.2 on September 22, 2026.

The core issue is an unauthenticated file inclusion bug. According to the security advisory reported by The Hacker News, an attacker can exploit this flaw to force a WordPress site to load a PHP file from a directory outside the standard theme folders. This alone is a serious breach, but the risk escalates dramatically on specific server configurations.

"On certain common server setups, this vulnerability can be escalated from file inclusion to full remote code execution," states the report. This means an attacker could upload and run their own malicious code, leading to complete compromise of the website and potentially the underlying server. The risk is particularly high for environments running PHP with the allow_url_include directive enabled, a setting that allows PHP to include files from remote URLs.

The severity is underscored by the breadth of the patch. WordPress has not only fixed the latest version (7.1.2) but has also backported the security patch to every supported branch, stretching back to version 4.7. This indicates the vulnerable code has been present in the WordPress core for a significant period, placing millions of active installations at potential risk.

For administrators managing WordPress sites, the patching timeline is critical. Public disclosure creates a narrow window for defense before automated exploitation tools begin scanning for unpatched sites.

Administrator Actions Required

All WordPress site owners are strongly advised to take the following steps without delay:

  1. Update Immediately: Log in to the WordPress admin dashboard and update to version 7.1.2 or the latest patched version for your branch (e.g., 6.x, 5.x, etc.). Always perform a full backup of the site files and database before applying any update.
  2. Review Server Settings: Site administrators with direct server access should audit their PHP settings. Specifically, check that the allow_url_include directive is set to Off to mitigate the most severe exploitation path. This is a critical hardening measure.
  3. Scan for Indicators of Compromise: Even after patching, administrators should review the site for signs of compromise. Look for unexpected files in the uploads directory or any suspicious administrative user accounts that were not created by authorized personnel.

The public disclosure of this critical flaw means that malicious actors are actively seeking vulnerable targets. Applying the latest security patch is now a non-negotiable priority to prevent site defacement, data theft, or use in further attacks.

WordPress 已發佈緊急安全更新，以修補其核心軟件中的一個嚴重漏洞。該漏洞可能允許攻擊者在無需任何憑證的情況下控制網站。此缺陷與 WordPress 7.1.2 於 2026 年 9 月 22 日發佈時同步披露，要求網站管理員立即採取行動。

核心問題是一個未驗證的檔案包含漏洞。根據 The Hacker News 報導的安全公告，攻擊者可利用此漏洞強制 WordPress 站點加載來自標準主題資料夾之外目錄的 PHP 檔案。這本身已是嚴重的安全漏洞，但在特定伺服器設定下，風險會急劇升高。

報告指出：「在某些常見的伺服器設定中，此漏洞可從檔案包含升級為完整的遠端代碼執行（RCE）。」這意味著攻擊者可以上傳並運行惡意代碼，導致網站及底層伺服器被完全控制。對於啟用了 allow_url_include 指令的 PHP 環境（此設定允許 PHP 包含遠端 URL 的檔案），風險尤為嚴重。

修補範圍之廣凸顯了問題的嚴重性。WordPress 不僅修復了最新版本（7.1.2），還將安全補丁回溯移植至所有受支持的分支版本，最早可追溯至 4.7 版。這表明存在漏洞的代碼已在 WordPress 核心中存在相當長時間，使數百萬現活躍安裝面臨潛在風險。

對於管理 WordPress 站點的管理員而言，修補時間至關重要。公開披露漏洞後，在自動化漏洞利用工具開始掃描未修補站點之前，防禦的窗口期極為短暫。

需管理員採取的行動

強烈建議所有 WordPress 站點擁有者立即採取以下步驟：

  1. 立即更新： 登入 WordPress 管理後台，更新至 7.1.2 版本或您所用分支的最新修補版本（例如 6.x、5.x 等）。套用任何更新前，務必對網站檔案和數據庫進行完整備份。
  2. 檢查伺服器設定： 擁有伺服器直接存取權限的站點管理員應審核其 PHP 設定。具體而言，檢查 allow_url_include 指令是否已設為 Off，以緩解最嚴重的利用路徑。這是一項關鍵的強化措施。
  3. 掃描入侵跡象： 即使修補後，管理員仍應檢查網站是否有被入侵的跡象。留意上載目錄中是否存在異常檔案，或任何並非由授權人員創建的可疑管理員帳戶。

此嚴重漏洞的公開披露意味著惡意攻擊者正積極尋找脆弱的目標。套用最新安全補丁現已成為防止網站被篡改、數據被盜用或被用於後續攻擊的不可協商的優先事項。

新聞來源 / Original News Source