漏洞概述 该漏洞涉及WordPress插件“User Registration”的 文件。具体问题是，在处理会员订阅和支付相关逻辑时，存在代码注入风险。攻击者可以通过构造特定的输入，导致代码执行，从而可能获取服务器控制权或执行恶意操作。 影响范围 插件名称：User Registration 受影响版本：5.2.0 受影响文件： 修复方案 1. 更新插件：建议用户立即将User Registration插件更新至最新版本，以修复此漏洞。 2. 代码审查：开发者应仔细审查 文件中的相关代码，确保所有用户输入都经过严格的验证和过滤。 3. 安全编码实践：遵循安全编码最佳实践，避免直接使用用户输入执行代码，使用参数化查询和预编译语句等安全措施。 POC代码 以下是截图中显示的POC代码块： ```php // Line 620-625 if ( ! empty( $membership_process['upgrade'] ) && isset( $membership_process['upgrade'] ) ) { $is_upgrading = true; $membership_process['upgrade'] = $membership_process['upgrade'] && isset( $membership_process['upgrade'] ); } // Line 630-635 if ( ! empty( $membership_process['multiple'] ) && isset( $membership_process['multiple'] ) ) { $is_renewing = true; $membership_process['multiple'] = $membership_process['multiple'] && isset( $membership_process['multiple'] ); } // Line 640-645 if ( ! empty( $membership_process['renew'] ) && isset( $membership_process['renew'] ) ) { $is_renewing = true; $membership_process['renew'] = $membership_process['renew'] && isset( $membership_process['renew'] ); } // Line 650-655 if ( ! empty( $membership_process['post_id'] ) ) { $is_upgrading = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 660-665 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 670-675 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 680-685 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 690-695 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 700-705 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 710-715 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 720-725 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 730-735 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 740-745 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 750-755 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 760-765 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 770-775 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 780-785 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 790-795 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 800-805 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 810-815 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 820-825 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 830-835 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $membership_process['post_id'] ); } // Line 840-845 if ( ! empty( $membership_process['post_id'] ) ) { $is_renewing = true; $membership_process['post_id'] = $membership_process['post_id'] && isset( $m