WP Editor <= 1.2.9.2 漏洞总结 漏洞概述 漏洞类型：跨站请求伪造 (CSRF) 导致远程代码执行 (RCE)。 CVSS 评分：8.8 原因：WP Editor 插件在 和 函数中缺少 nonce 验证。 后果：未认证的攻击者可以覆盖任意插件和主题的 PHP 文件。 影响范围 软件名称：WP Editor 受影响版本：<= 1.2.9.2 受影响版本列表： WP Editor <= 1.2.9.1 - Authenticated (Administrator) Directory Traversal to Arbitrary File Read WP Editor <= 1.2.9.1 - Authenticated (Administrator) Directory Traversal to Arbitrary File Update WP Editor <= 1.2.9 - Authenticated (Admin) PHAR Deserialization WP Editor <= 1.2.8 - Reflected Cross-Site Scripting WP Editor <= 1.2.7 - Sensitive Information Exposure via log file WP Editor <= 1.2.6.3 - Authenticated (Admin) SQL Injection WP Editor <= 1.2.6 - Incorrect Permission Assignment or Protection WP Editor <= 1.2.6.2 - Cross-Site Scripting WP Editor <= 1.2.6 - Cross-Site Request Forgery 修复方案 修复版本：1.2.9.3 建议：更新到 1.2.9.3 或任何已修补的版本。