漏洞概述 该漏洞涉及WordPress插件“Accessibility Checker”中的文件包含漏洞。具体来说，漏洞位于 文件中，该文件用于在WordPress后台加载样式和脚本。 影响范围 受影响版本：1.41.0 影响组件： 影响功能：后台管理页面的样式和脚本加载 修复方案 1. 更新插件：建议用户将插件更新到最新版本，以修复已知的安全漏洞。 2. 代码审查：对插件代码进行安全审查，确保没有类似的文件包含漏洞。 3. 输入验证：对所有用户输入进行严格的验证和过滤，防止恶意输入导致文件包含。 POC代码 以下是与漏洞相关的代码片段： ```php ID ) ? $post->ID : null; wp_enqueue_script( 'edac', plugin_dir_url( EDAC_PLUGIN_FILE ) . 'build/admin.bundle.js', [ 'jquery' ], EDAC_VERSION, false ); wp_set_script_translations( 'edac', 'accessibility-checker', plugin_dir_path( EDAC_PLUGIN_FILE ) . 'languages' ); wp_localize_script( 'edac', 'edac', [ 'postId' => $post_id, 'nonce' => wp_create_nonce( 'ajax-nonce' ), 'adminUrl' => esc_url( admin_url( 'admin-ajax.php' ) ), 'restUrl' => esc_url( rest_url() ), 'baseUrl' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postType' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postStatus' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postDate' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postAuthor' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postTitle' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postContent' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postExcerpt' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFormat' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postCategory'=> esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postTag' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postMeta' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postCustomFields' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postRevisions' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postAutosave' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postTrash' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postPending' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postDraft' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postPrivate' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postPassword'=> esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postSticky' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFeaturedImage' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLargeThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postMediumThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postSmallThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postOriginal' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postMedium' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postSmall' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLarge' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postOriginal' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLarge' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postOriginal' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLarge' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postOriginal' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLarge' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postOriginal' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLarge' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postOriginal' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postThumbnail' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postLarge' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' ), 'postFullSize' => esc_url( raw_url( rest_url() ) . 'accessibility-checker/v1' )