Sécurité WordPress aujourd’hui : extensions, WordPress et PHP

Dernières vulnérabilités critiques et élevées

Mettez à jour ou remplacez ces extensions en priorité. Demandez à votre agent de vérifier les vôtres avec wp_security.

HIGHGiveWPAuthenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter · up to 4.19.1 · fixed in 4.19.1.14 Nov

HIGHLiteSpeed CacheUnauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching · up to 7.9.1 · fixed in 7.9.24 Nov

HIGHMotorsAuthenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter · up to 1.4.128 · fixed in 1.4.1294 Nov

HIGHSAML SP Single Sign OnAllocation of Resources Without Limits or Throttling · up to 6.1.04 Nov

HIGHDoofinder for WooCommerceInsertion of Sensitive Information into Externally-Accessible File or Directory · up to 2.17.24 Nov

HIGHWCFM MarketplaceMissing Authorization · up to 3.8.24 Nov

HIGHStape Conversion TrackingServer-Side Request Forgery · before 2.3.114 Nov

HIGHNoptinCross-site Scripting · up to 4.4.24 Nov

HIGHWP Customer AreaCross-site Scripting · up to 8.4.14 Nov

HIGHWP Booking SystemCross-site Scripting · up to 2.1.0.64 Nov

Votre site est-il touché ?Collez ceci à votre agent. Il lit vos versions avec WP-CLI et vérifie chaque extension et chaque thème en un seul appel.

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Que faire maintenant

2 NovSécurité

HTTP2Shell: critical Brotli flaw reachable through WordPress

Ask the host whether the Brotli decoder serving the site is patched for CVE-2026-111497 and the services were restarted after the update (on a VPS, update the system packages, then restart). Blocking unauthenticated XML-RPC pingbacks removes only the route shown in the public exploit and may break integrations; the xmlrpc_enabled filter and the Settings > Discussion option do not block them. Source

29 OctSécurité

Core Security Initiative: security releases now come often

Keep automatic minor (security) updates on, and expect more security releases: apply each one quickly rather than batching updates. Source

28 OctSécurité

WordPress 7.1.4 security release

Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7. Source

21 OctPHP

Critical PHP security release

Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server). Source

16 OctMCP

MCP Adapter 0.7.1 and 0.6.2 security fixes

Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on ability_not_public_mcp. Source

6 OctSécurité

WordPress 7.1.3 security and maintenance release

Update to WordPress 7.1.3 or later (7.1.4 is current). Source

Vérifiez vos extensions et vos thèmes

Donnez à votre agent les extensions et les thèmes de votre site. Pour chacun, il reçoit la dernière version, si vous êtes en retard, et ce qu’il faut surveiller.

Formulo2.1 → 2.3Mise à jour

Pebble Forms1.1À jour

Formwise3.8Pas testée avec WordPress 7.1

Ce que votre agent reçoit de wp_security

Liste les extensions de mon site avec leurs versions, puis vérifie-les avec Today WP.

Une extension de mon site est-elle obsolète ou non testée avec le WordPress actuel ?

La sécurité WordPress, aujourd’hui.