WishList Member X < 3.26.7 - 认证 (订阅者+) 任意文件删除

该漏洞允许经过身份验证的攻击者，即使是 Subscriber 级别的用户，删除服务器上的任意文件。攻击者可以利用此漏洞删除关键配置文件，例如 wp-config.php，从而完全控制网站。删除 wp-config.php 文件将导致网站无法正常运行，并可能允许攻击者上传恶意代码并执行任意命令。攻击者还可以删除其他重要文件，从而破坏网站的完整性和可用性。此漏洞的潜在影响非常严重，可能导致数据泄露、网站劫持和进一步的攻击。

WordPress websites utilizing the Wishlist Member plugin, particularly those running versions prior to 3.26.7, are at risk. Shared hosting environments are especially vulnerable, as they often have limited file permission controls and a higher density of WordPress installations, increasing the potential attack surface. Sites with legacy WordPress configurations or those that haven't implemented robust security practices are also at heightened risk.

• wordpress / composer / npm:

grep -r 'wishlist_member_delete_file' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=active | grep Wishlist Member

• wordpress / composer / npm:

wp plugin update wishlist-member --version=3.26.7

• generic web: Check WordPress access logs for requests containing suspicious file paths or deletion attempts targeting sensitive files like wp-config.php.

1. 2024-06-20Disclosure

   disclosure

1. 已保留2024-06-03
2. 发布日期2024-06-20
3. 修改日期2026-02-26
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 Wishlist Member 插件升级至 3.26.7 或更高版本。如果无法立即升级，可以尝试限制文件上传权限，并确保 WordPress 网站的安全性配置良好。此外，可以考虑使用 Web 应用防火墙 (WAF) 来检测和阻止恶意文件删除请求。监控 WordPress 网站的日志文件，查找异常的文件删除活动。升级后，请验证插件是否已成功更新，并检查网站是否正常运行。