今日のWordPressセキュリティ:プラグイン、WordPress、PHP

最新の重大・高リスクのプラグイン脆弱性

これらのプラグインを優先して更新または置き換えてください。あなたのプラグインはエージェントに確認させましょう: wp_security.

HIGHGiveWPAuthenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter · up to 4.19.1 · fixed in 4.19.1.14 Nov

HIGHLiteSpeed CacheUnauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching · up to 7.9.1 · fixed in 7.9.24 Nov

HIGHMotorsAuthenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter · up to 1.4.128 · fixed in 1.4.1294 Nov

HIGHSAML SP Single Sign OnAllocation of Resources Without Limits or Throttling · up to 6.1.04 Nov

HIGHDoofinder for WooCommerceInsertion of Sensitive Information into Externally-Accessible File or Directory · up to 2.17.24 Nov

HIGHWCFM MarketplaceMissing Authorization · up to 3.8.24 Nov

HIGHStape Conversion TrackingServer-Side Request Forgery · before 2.3.114 Nov

HIGHNoptinCross-site Scripting · up to 4.4.24 Nov

HIGHWP Customer AreaCross-site Scripting · up to 8.4.14 Nov

HIGHWP Booking SystemCross-site Scripting · up to 2.1.0.64 Nov

あなたのサイトは影響を受けていますか?これをエージェントに貼り付けてください。WP-CLIでバージョンを読み取り、すべてのプラグインとテーマを1回で確認します。

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

今やること

2 Novセキュリティ

HTTP2Shell: critical Brotli flaw reachable through WordPress

Ask the host whether the Brotli decoder serving the site is patched for CVE-2026-111497 and the services were restarted after the update (on a VPS, update the system packages, then restart). Blocking unauthenticated XML-RPC pingbacks removes only the route shown in the public exploit and may break integrations; the xmlrpc_enabled filter and the Settings > Discussion option do not block them. 出典

29 Octセキュリティ

Core Security Initiative: security releases now come often

Keep automatic minor (security) updates on, and expect more security releases: apply each one quickly rather than batching updates. 出典

28 Octセキュリティ

WordPress 7.1.4 security release

Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7. 出典

21 OctPHP

Critical PHP security release

Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server). 出典

16 OctMCP

MCP Adapter 0.7.1 and 0.6.2 security fixes

Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on ability_not_public_mcp. 出典

6 Octセキュリティ

WordPress 7.1.3 security and maintenance release

Update to WordPress 7.1.3 or later (7.1.4 is current). 出典

プラグインとテーマを確認

サイトのプラグインとテーマをエージェントに渡すと、それぞれの最新バージョン、遅れているか、注意点が分かります。

Formulo2.1 → 2.3要更新

Pebble Forms1.1最新

Formwise3.8WordPress 7.1で未テスト

エージェントが受け取る内容: wp_security

サイトのプラグインをバージョン付きで一覧にして、Today WPでチェックして。

サイトに古いプラグインや、今のWordPressで未テストのものはある?

今日のWordPressセキュリティ。