{"schema":"hottub-news/story/v1","story":"st_5yqdb3adkur3tqhsqkta","title":"CISA警告甫修補的WordPress重大路徑遍歷漏洞遭到利用","title_en":"CISA warns of newly patched WordPress path traversal vulnerability being exploited","outlets":1,"brief":null,"page":"https://hottub.news/stories/cisa-warns-of-newly-patched-wordpress-path-traversal-vulnerability-5yqdb3adku","count":1,"items":[{"id":"n_5yqdb3adkur3tqhsqkta","seq":591803,"kind":"article","title":"CISA警告甫修補的WordPress重大路徑遍歷漏洞遭到利用","title_en":"CISA warns of newly patched WordPress path traversal vulnerability being exploited","url":"https://www.ithome.com.tw/news/179254","summary":"新聞 上週WordPress開發團隊 修補重大漏洞CVE-2026-87902 ，不到一天 資安公司Patchstack偵測到嘗試利用活動 ，週末美國網路安全與基礎設施安全局（CISA） 也確認該弱點遭到利用的情形 。 9月25日CISA將CVE-2026-87902 列入已遭利用的漏洞名單（KEV） ，原因是他們已掌握該弱點被積極利用的證據，並要求聯邦機構必須在 9月28日前 完成修補。CVE-2026-87902為遠端檔案包含漏洞，攻擊者在無須通過身分驗證的情況下，可試圖讓網頁範本解析機制包含可讀取的本機PHP檔案，只要網頁伺服器與已啟用的佈景主題符合特定條件，攻擊者就能遠端執行任意程式碼（RCE），CVSS v4.0嚴重程度評為9.2分。","published":"2026-09-29T04:24:46Z","seen":"2026-09-29T06:09:59Z","lang":"zh","country":"TW","source":{"id":"kite-ithome-com-tw-c23d09","name":"ithome.com.tw","domain":"ithome.com.tw","outlet":{"wikidata":"Q123398745","name":"iThome","type":"magazine","country":"TW","designations":["magazine","news website"]}},"via":"kite-ithome-com-tw-c23d09","authors":["周峻佑"],"entities":[{"id":"Q5205058","name":"Cybersecurity and Infrastructure Security Agency","type":"org"}],"story":"st_5yqdb3adkur3tqhsqkta","category":"science-technology","category_p":0.41999998688697815,"sentiment":"negative","tone":-0.5899999737739563,"political":0.20999999344348907}]}