{"id":114562,"date":"2026-11-12T11:58:40","date_gmt":"2026-11-12T10:58:40","guid":{"rendered":"https:\/\/www.codeur.com\/blog\/?p=114562"},"modified":"2026-11-12T11:58:41","modified_gmt":"2026-11-12T10:58:41","slug":"faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification","status":"publish","type":"post","link":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/","title":{"rendered":"Faille critique WordPress&nbsp;: ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#8217;exploitation"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong><strong>WPScan a publi\u00e9, le 6 novembre 2026, une alerte<\/strong> not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d&#8217;envoyer un fichier sur le serveur puis de l&#8217;ex\u00e9cuter. Elle est d\u00e9j\u00e0 utilis\u00e9e dans des attaques et l&#8217;\u00e9diteur n&#8217;a sorti aucune mise \u00e0 jour. Voici comment savoir si votre site est concern\u00e9 et quoi faire d\u00e8s aujourd&#8217;hui.<\/strong><\/p>\n\n\n\n<div class=\"article-summary\">\n  <h3>En bref<\/h3>\n  <ul>\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE&nbsp;:<\/strong> <a href=\"https:\/\/wpscan.com\/vulnerability\/3a3556f0-fc36-4f68-b826-406a7b4c3f9e\/\" target=\"_blank\" rel=\"noopener\">CVE-2026-123751<\/a><\/li>\n\n\n\n<li><strong>Gravit\u00e9&nbsp;:<\/strong> 9,8 \/ 10 (critique, CVSS 3.1)<\/li>\n\n\n\n<li><strong>Plugin&nbsp;:<\/strong> WP Duplicate \u2013 WordPress Migration Plugin (ex-LocalSync)<\/li>\n\n\n\n<li><strong>Versions touch\u00e9es&nbsp;:<\/strong> 1.1.11 et ant\u00e9rieures<\/li>\n\n\n\n<li><strong>Impact&nbsp;:<\/strong> envoi de fichiers sans authentification, ex\u00e9cution de code \u00e0 distance<\/li>\n\n\n\n<li><strong>Statut&nbsp;:<\/strong> exploit\u00e9e activement<\/li>\n\n\n\n<li><strong>Correctif&nbsp;:<\/strong> aucun<\/li>\n\n\n\n<li><strong>Action&nbsp;:<\/strong> supprimer le plugin imm\u00e9diatement<\/li>\n<\/ul>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Ce que l&#8217;on sait de la faille<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a target=\"_blank\" rel=\"noopener\" href=\"https:\/\/wordpress.org\/plugins\/local-sync\/\">WP Duplicate<\/a>, l&#8217;ancien LocalSync, permet de cloner un site ou de le transf\u00e9rer d&#8217;un h\u00e9bergeur \u00e0 un autre. Le chercheur <a target=\"_blank\" rel=\"noopener\" href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/researchers\/mike-gozdiskowski-2\">Mike Gozdiskowski<\/a> a trouv\u00e9 le probl\u00e8me dans toutes les versions jusqu&#8217;\u00e0 la 1.1.11.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En pratique, le plugin contr\u00f4le mal la cl\u00e9 cens\u00e9e authentifier les requ\u00eates. Il ne v\u00e9rifie pas non plus le type ni l&#8217;emplacement des fichiers qu&#8217;on lui envoie. Un attaquant peut donc d\u00e9poser un script PHP o\u00f9 il veut et prendre la main sur le site.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1240\" height=\"620\" src=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress.png\" alt=\"\" class=\"wp-image-114563\" srcset=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress.png 1240w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-300x150.png 300w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-370x185-1.png 370w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-768x384.png 768w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-270x135.png 270w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-60x30.png 60w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-570x285.png 570w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-740x370.png 740w, https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/schema-attaque-wordpress-1024x512.png 1024w\" sizes=\"(max-width: 1240px) 100vw, 1240px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">WPScan confirme des attaques en cours, sans donner de chiffres ni d&#8217;indicateurs. Ce n&#8217;est pas la premi\u00e8re alerte de l&#8217;ann\u00e9e pour ce plugin. Deux autres failles (CVE-2026-1499 et CVE-2026-39755) permettaient d\u00e9j\u00e0 d&#8217;envoyer des fichiers, avec un simple compte abonn\u00e9 cette fois.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">L&#8217;alerte tombe trois semaines apr\u00e8s une s\u00e9rie de failles critiques sur PHP2Shell, Node.js et GitLab, que nous d\u00e9taillions dans notre article sur <a href=\"https:\/\/www.codeur.com\/blog\/failles-critiques-php2shell-nodejs-gitlab\/\">les failles critiques d\u00e9j\u00e0 exploit\u00e9es par les pirates<\/a>. Avec PHP2Shell, une simple requ\u00eate suffisait aussi \u00e0 prendre le contr\u00f4le d&#8217;un site sans mot de passe. Une diff\u00e9rence de taille, pourtant&nbsp;: des correctifs existaient pour ces failles. Pour WP Duplicate, il n&#8217;y en a aucun, et la suppression du plugin reste la seule protection.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pourquoi un plugin de migration est si expos\u00e9<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pour d\u00e9m\u00e9nager un site, un <a href=\"https:\/\/www.codeur.com\/blog\/migrer-site-wordpress\/\">plugin de migration<\/a> doit pouvoir tout faire&nbsp;: <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Il lit et \u00e9crit des fichiers sur le serveur ;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Exporte la base de donn\u00e9es avec les comptes et les donn\u00e9es clients ;<\/li>\n\n\n\n<li>G\u00e9n\u00e8re des sauvegardes compl\u00e8tes ;<\/li>\n\n\n\n<li>Une seule faille dans ce type d&#8217;outil ouvre donc l&#8217;acc\u00e8s \u00e0 tout le reste.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Le vrai souci, c&#8217;est l&#8217;oubli. On installe le plugin pour une migration, tout se passe bien, et personne ne pense \u00e0 le retirer. Quelques mois plus tard, il est toujours l\u00e0, jamais mis \u00e0 jour, et plus personne ne le surveille.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Comment savoir si vous \u00eates concern\u00e9&nbsp;?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">La v\u00e9rification prend quelques minutes.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Dans l&#8217;administration WordPress, ouvrez <em>Extensions<\/em> et cherchez WP Duplicate ou LocalSync. Notez au passage les autres <a href=\"https:\/\/www.codeur.com\/blog\/plugin-gratuit-sauvegarde-wordpress\/\">outils de migration ou de sauvegarde<\/a> (Duplicator, All-in-One WP Migration, UpdraftPlus\u2026).<\/li>\n\n\n\n<li>Regardez aussi les plugins d\u00e9sactiv\u00e9s. Leurs fichiers restent sur le serveur et certains peuvent \u00eatre appel\u00e9s directement.<\/li>\n\n\n\n<li>Comparez les versions install\u00e9es avec les bases d&#8217;alertes comme WPScan, Patchstack ou Wordfence.<\/li>\n\n\n\n<li>Fouillez <code>wp-content<\/code> \u00e0 la recherche d&#8217;archives laiss\u00e9es par d&#8217;anciennes migrations (<code>.zip<\/code>, <code>.sql<\/code>, <code>.wpress<\/code>).<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Si vous trouvez WP Duplicate, le d\u00e9sactiver ne suffit pas. <strong>Il faut le supprimer.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Migrer sans laisser de porte ouverte<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Le principe est simple. Le plugin de migration s&#8217;installe le jour du transfert et se supprime d\u00e8s que le nouveau site tourne, sur l&#8217;ancien serveur comme sur le nouveau. Les archives qu&#8217;il a cr\u00e9\u00e9es partent avec lui, ou sortent au moins du dossier public.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avant d&#8217;installer un outil de ce genre, jetez un \u0153il \u00e0 sa derni\u00e8re mise \u00e0 jour et \u00e0 son historique de failles. Un d\u00e9veloppeur peut aussi s&#8217;en passer compl\u00e8tement et transf\u00e9rer fichiers et base par SFTP et WP-CLI.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pensez enfin \u00e0 <a href=\"https:\/\/www.codeur.com\/maintenance-site-wordpress\">faire le m\u00e9nage chaque trimestre<\/a>. Un plugin qui ne sert plus n&#8217;a rien \u00e0 faire sur le site. Notre guide pour <a href=\"https:\/\/www.codeur.com\/blog\/securiser-site-wordpress\/\">s\u00e9curiser un site WordPress<\/a> d\u00e9taille les autres protections \u00e0 mettre en place.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Et si le site a d\u00e9j\u00e0 \u00e9t\u00e9 attaqu\u00e9&nbsp;?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Si WP Duplicate \u00e9tait install\u00e9, mieux vaut partir du principe que quelqu&#8217;un a pu entrer. WPScan n&#8217;a publi\u00e9 aucun indicateur de compromission, alors on cherche les traces habituelles.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sauvegardez le site dans son \u00e9tat actuel avant de toucher \u00e0 quoi que ce soit.<\/li>\n\n\n\n<li>Cherchez des fichiers PHP dans <code>wp-content\/uploads<\/code>. Ce dossier ne devrait contenir que des m\u00e9dias.<\/li>\n\n\n\n<li>Passez en revue les comptes administrateurs et supprimez ceux que vous ne reconnaissez pas.<\/li>\n\n\n\n<li>Changez tous les mots de passe (WordPress, FTP, base de donn\u00e9es, h\u00e9bergeur).<\/li>\n\n\n\n<li>Lancez un scan avec un <a href=\"https:\/\/www.codeur.com\/blog\/plugins-securite-wordpress\/\">plugin de s\u00e9curit\u00e9 WordPress<\/a> comme Wordfence ou demandez une analyse \u00e0 votre h\u00e9bergeur.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Un nettoyage fait \u00e0 moiti\u00e9 laisse souvent une porte d\u00e9rob\u00e9e que l&#8217;attaquant reviendra utiliser.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Besoin d&#8217;aide&nbsp;?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>WP Duplicate est install\u00e9 sur votre site, votre version de PHP n&#8217;est pas corrig\u00e9e contre PHP2Shell, ou vous avez un doute&nbsp;?<\/strong> Faites intervenir un <a href=\"https:\/\/www.codeur.com\/developpeur\/wordpress\" target=\"_blank\" rel=\"noopener\">d\u00e9veloppeur ex<\/a><a href=\"https:\/\/www.codeur.com\/developpeur\/wordpress\">p<\/a><a href=\"https:\/\/www.codeur.com\/developpeur\/wordpress\" target=\"_blank\" rel=\"noopener\">\u00e9riment\u00e9<\/a>. Il d\u00e9commissionnera les composants vuln\u00e9rables, appliquera les mises \u00e0 jour de s\u00e9curit\u00e9 n\u00e9cessaires, v\u00e9rifiera que le site n&#8217;a pas \u00e9t\u00e9 compromis et le s\u00e9curisera. Sur <a href=\"https:\/\/www.codeur.com\/\">Codeur<\/a>, vous pouvez d\u00e9crire votre besoin gratuitement et trouver un freelance disponible dans la journ\u00e9e.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/wpscan.com\/vulnerability\/3a3556f0-fc36-4f68-b826-406a7b4c3f9e\/\" target=\"_blank\" rel=\"noopener\">WPScan \u2013 WP Duplicate &lt;= 1.1.11, Unauthenticated Arbitrary File Upload<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/securityonline.info\/wp-duplicate-vulnerability-cve-2026-123751-exploited\/\" target=\"_blank\" rel=\"noopener\">SecurityOnline \u2013 CVE-2026-123751 exploited in the wild<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.strix.ai\/cve\/CVE-2026-123751\" target=\"_blank\" rel=\"noopener\">Strix \u2013 CVE-2026-123751<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/patchstack.com\/database\/wordpress\/plugin\/local-sync\/vulnerability\/wordpress-wp-duplicate-plugin-1-1-11-arbitrary-file-upload-vulnerability\" target=\"_blank\" rel=\"noopener\">Patchstack \u2013 WP Duplicate &lt;= 1.1.11, Arbitrary File Upload<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/freshysites.com\/security-bulletins\/wordpress-security-bulletin-wp-duplicate-plugin-vulnerability-cve-2026-1499\/\" target=\"_blank\" rel=\"noopener\">Freshy \u2013 CVE-2026-1499<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d&#8217;envoyer un fichier sur le serveur puis de l&#8217;ex\u00e9cuter. Elle est d\u00e9j\u00e0 utilis\u00e9e dans des attaques et l&#8217;\u00e9diteur n&#8217;a sorti aucune mise \u00e0 jour. Voici comment savoir si votre site est concern\u00e9 et quoi faire d\u00e8s [&hellip;]<\/p>\n","protected":false},"author":72,"featured_media":114576,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[14,16,24],"tags":[39],"class_list":["post-114562","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-developpement","category-securite","category-wordpress","tag-conseils"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Faille critique WordPress : ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#039;exploitation<\/title>\n<meta name=\"description\" content=\"WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d&#039;envoyer un fichier sur le serveur puis de\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Faille critique WordPress : ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#039;exploitation\" \/>\n<meta property=\"og:description\" content=\"WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d&#039;envoyer un fichier sur le serveur puis de\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/\" \/>\n<meta property=\"og:site_name\" content=\"Codeur.com\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/fr-fr.facebook.com\/codeurfreelance\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-12T10:58:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-12T10:58:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/image-une-faille-wordpress-v2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jonathan Girard\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@codeur\" \/>\n<meta name=\"twitter:site\" content=\"@codeur\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jonathan Girard\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/\"},\"author\":{\"name\":\"Jonathan Girard\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/person\\\/3445e0b4ccbe05223b0b9f4eeabd487c\"},\"headline\":\"Faille critique WordPress&nbsp;: ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#8217;exploitation\",\"datePublished\":\"2026-11-12T10:58:40+00:00\",\"dateModified\":\"2026-11-12T10:58:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/\"},\"wordCount\":938,\"publisher\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/image-une-faille-wordpress-v2.jpg\",\"keywords\":[\"Conseils\"],\"articleSection\":[\"D\u00e9veloppement\",\"S\u00e9curit\u00e9\",\"Wordpress\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/\",\"name\":\"Faille critique WordPress : ex\u00e9cution de code \u00e0 distance sans authentification en cours d'exploitation\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/image-une-faille-wordpress-v2.jpg\",\"datePublished\":\"2026-11-12T10:58:40+00:00\",\"dateModified\":\"2026-11-12T10:58:41+00:00\",\"description\":\"WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\\\/10. La faille permet \u00e0 un attaquant sans compte, d'envoyer un fichier sur le serveur puis de\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/image-une-faille-wordpress-v2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/image-une-faille-wordpress-v2.jpg\",\"width\":1200,\"height\":675},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"D\u00e9veloppement\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/developpement\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"S\u00e9curit\u00e9\",\"item\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/developpement\\\/securite\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Faille critique WordPress&nbsp;: ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#8217;exploitation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/\",\"name\":\"Codeur.com\",\"description\":\"codeur\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#organization\",\"name\":\"Codeur.com\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/logo-codeur-com.png\",\"contentUrl\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/logo-codeur-com.png\",\"width\":2560,\"height\":465,\"caption\":\"Codeur.com\"},\"image\":{\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/fr-fr.facebook.com\\\/codeurfreelance\\\/\",\"https:\\\/\\\/x.com\\\/codeur\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/codeur\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCgj9ySM9xy3gdL8qBafl9Uw\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/#\\\/schema\\\/person\\\/3445e0b4ccbe05223b0b9f4eeabd487c\",\"name\":\"Jonathan Girard\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/09d3632ccd2e8826230df10f4e720d880fd6637657a401b9d91457258a570830?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/09d3632ccd2e8826230df10f4e720d880fd6637657a401b9d91457258a570830?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/09d3632ccd2e8826230df10f4e720d880fd6637657a401b9d91457258a570830?s=96&d=mm&r=g\",\"caption\":\"Jonathan Girard\"},\"description\":\"Fort de plus de 20 ans d\u2019exp\u00e9rience dans le digital, il a pilot\u00e9 des strat\u00e9gies e-commerce, SEO, CRM et produit dans les secteurs de l\u2019information, de la formation et du SaaS. Il partage ici sa vision du marketing digital et des bonnes pratiques pour faire grandir un projet en ligne.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/jonathan-girard\"],\"url\":\"https:\\\/\\\/www.codeur.com\\\/blog\\\/author\\\/jonathan\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Faille critique WordPress : ex\u00e9cution de code \u00e0 distance sans authentification en cours d'exploitation","description":"WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d'envoyer un fichier sur le serveur puis de","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/","og_locale":"fr_FR","og_type":"article","og_title":"Faille critique WordPress : ex\u00e9cution de code \u00e0 distance sans authentification en cours d'exploitation","og_description":"WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d'envoyer un fichier sur le serveur puis de","og_url":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/","og_site_name":"Codeur.com","article_publisher":"https:\/\/fr-fr.facebook.com\/codeurfreelance\/","article_published_time":"2026-11-12T10:58:40+00:00","article_modified_time":"2026-11-12T10:58:41+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/image-une-faille-wordpress-v2.jpg","type":"image\/jpeg"}],"author":"Jonathan Girard","twitter_card":"summary_large_image","twitter_creator":"@codeur","twitter_site":"@codeur","twitter_misc":{"\u00c9crit par":"Jonathan Girard","Dur\u00e9e de lecture estim\u00e9e":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#article","isPartOf":{"@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/"},"author":{"name":"Jonathan Girard","@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/person\/3445e0b4ccbe05223b0b9f4eeabd487c"},"headline":"Faille critique WordPress&nbsp;: ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#8217;exploitation","datePublished":"2026-11-12T10:58:40+00:00","dateModified":"2026-11-12T10:58:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/"},"wordCount":938,"publisher":{"@id":"https:\/\/www.codeur.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#primaryimage"},"thumbnailUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/image-une-faille-wordpress-v2.jpg","keywords":["Conseils"],"articleSection":["D\u00e9veloppement","S\u00e9curit\u00e9","Wordpress"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/","url":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/","name":"Faille critique WordPress : ex\u00e9cution de code \u00e0 distance sans authentification en cours d'exploitation","isPartOf":{"@id":"https:\/\/www.codeur.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#primaryimage"},"image":{"@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#primaryimage"},"thumbnailUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/image-une-faille-wordpress-v2.jpg","datePublished":"2026-11-12T10:58:40+00:00","dateModified":"2026-11-12T10:58:41+00:00","description":"WPScan a publi\u00e9, le 6 novembre 2026, une alerte not\u00e9e 9,8\/10. La faille permet \u00e0 un attaquant sans compte, d'envoyer un fichier sur le serveur puis de","breadcrumb":{"@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#primaryimage","url":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/image-une-faille-wordpress-v2.jpg","contentUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2026\/11\/image-une-faille-wordpress-v2.jpg","width":1200,"height":675},{"@type":"BreadcrumbList","@id":"https:\/\/www.codeur.com\/blog\/faille-critique-wordpress-wp-duplicate-execution-de-code-a-distance-sans-authentification\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.codeur.com\/blog\/"},{"@type":"ListItem","position":2,"name":"D\u00e9veloppement","item":"https:\/\/www.codeur.com\/blog\/developpement\/"},{"@type":"ListItem","position":3,"name":"S\u00e9curit\u00e9","item":"https:\/\/www.codeur.com\/blog\/developpement\/securite\/"},{"@type":"ListItem","position":4,"name":"Faille critique WordPress&nbsp;: ex\u00e9cution de code \u00e0 distance sans authentification en cours d&#8217;exploitation"}]},{"@type":"WebSite","@id":"https:\/\/www.codeur.com\/blog\/#website","url":"https:\/\/www.codeur.com\/blog\/","name":"Codeur.com","description":"codeur","publisher":{"@id":"https:\/\/www.codeur.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.codeur.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/www.codeur.com\/blog\/#organization","name":"Codeur.com","url":"https:\/\/www.codeur.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2022\/04\/logo-codeur-com.png","contentUrl":"https:\/\/www.codeur.com\/blog\/wp-content\/uploads\/2022\/04\/logo-codeur-com.png","width":2560,"height":465,"caption":"Codeur.com"},"image":{"@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/fr-fr.facebook.com\/codeurfreelance\/","https:\/\/x.com\/codeur","https:\/\/www.linkedin.com\/company\/codeur\/","https:\/\/www.youtube.com\/channel\/UCgj9ySM9xy3gdL8qBafl9Uw"]},{"@type":"Person","@id":"https:\/\/www.codeur.com\/blog\/#\/schema\/person\/3445e0b4ccbe05223b0b9f4eeabd487c","name":"Jonathan Girard","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/09d3632ccd2e8826230df10f4e720d880fd6637657a401b9d91457258a570830?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/09d3632ccd2e8826230df10f4e720d880fd6637657a401b9d91457258a570830?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/09d3632ccd2e8826230df10f4e720d880fd6637657a401b9d91457258a570830?s=96&d=mm&r=g","caption":"Jonathan Girard"},"description":"Fort de plus de 20 ans d\u2019exp\u00e9rience dans le digital, il a pilot\u00e9 des strat\u00e9gies e-commerce, SEO, CRM et produit dans les secteurs de l\u2019information, de la formation et du SaaS. Il partage ici sa vision du marketing digital et des bonnes pratiques pour faire grandir un projet en ligne.","sameAs":["https:\/\/www.linkedin.com\/in\/jonathan-girard"],"url":"https:\/\/www.codeur.com\/blog\/author\/jonathan\/"}]}},"_links":{"self":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts\/114562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/users\/72"}],"replies":[{"embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/comments?post=114562"}],"version-history":[{"count":11,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts\/114562\/revisions"}],"predecessor-version":[{"id":114575,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/posts\/114562\/revisions\/114575"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/media\/114576"}],"wp:attachment":[{"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/media?parent=114562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/categories?post=114562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.codeur.com\/blog\/wp-json\/wp\/v2\/tags?post=114562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}