{"id":40870,"date":"2026-09-23T09:29:53","date_gmt":"2026-09-23T02:29:53","guid":{"rendered":"https:\/\/dps.media\/cve-2026-87902-lo-hong-file-inclusion-wordpress\/"},"modified":"2026-09-23T09:29:53","modified_gmt":"2026-09-23T02:29:53","slug":"cve-2026-87902-file-inclusion-wordpress-vulnerability","status":"publish","type":"post","link":"https:\/\/dps.media\/zh\/cve-2026-87902-file-inclusion-wordpress-vulnerability\/","title":{"rendered":"CVE-2026-87902: L\u1ed7 H\u1ed5ng File Inclusion Nghi\u00eam Tr\u1ecdng Tr\u00ean WordPress V\u00e0 C\u00e1ch X\u1eed L\u00fd"},"content":{"rendered":"<?xml encoding=\"utf-8\" ?><p>WordPress v\u1eeba ph\u00e1t h\u00e0nh b\u1ea3n c\u1eadp nh\u1eadt <strong>7.1.2<\/strong> nh\u1eb1m v\u00e1 kh\u1ea9n c\u1ea5p m\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng trong m\u00e3 ngu\u1ed3n c\u1ed1t l\u00f5i (WordPress Core). L\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c \u0111\u1ecbnh danh l\u00e0 <strong>CVE-2026-87902<\/strong> v\u1edbi \u0111i\u1ec3m \u0111\u00e1nh gi\u00e1 nguy c\u01a1 CVSS l\u00ean t\u1edbi <strong>9.2<\/strong>, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ch\u01b0a x\u00e1c th\u1ef1c n\u1ea1p t\u1ec7p PHP c\u1ee5c b\u1ed9 (Local File Inclusion \u2013 LFI) v\u00e0 c\u00f3 th\u1ec3 leo thang th\u1ef1c thi m\u00e3 t\u1eeb xa (RCE) tr\u00ean m\u1ed9t s\u1ed1 c\u1ea5u h\u00ecnh m\u00e1y ch\u1ee7.<\/p><p>S\u1ef1 c\u1ed1 do chuy\u00ean gia b\u1ea3o m\u1eadt Robert Ressl ph\u00e1t hi\u1ec7n v\u00e0 b\u00e1o c\u00e1o ri\u00eang qua ch\u01b0\u01a1ng tr\u00ecnh HackerOne c\u1ee7a WordPress t\u1eeb th\u00e1ng 7. Ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng tr\u1ea3i d\u00e0i tr\u00ean m\u1ecdi phi\u00ean b\u1ea3n t\u1eeb <strong>4.7.0<\/strong> \u5230 <strong>7.1.1<\/strong> \u2013 t\u1ee9c g\u1ea7n m\u1ed9t th\u1eadp k\u1ef7 m\u00e3 ngu\u1ed3n WordPress.<\/p><p>N\u1ebfu b\u1ea1n \u0111ang s\u1eed d\u1ee5ng h\u1ec7 sinh th\u00e1i l\u01b0u tr\u1eef ho\u1eb7c <a href=\"https:\/\/dps.media\/zh\/wang-zhan-she-ji-fu-wu-2\/\">\u7f51\u7ad9\u8bbe\u8ba1\u670d\u52a1<\/a> t\u1ea1i DPS.MEDIA, b\u1ea1n ho\u00e0n to\u00e0n kh\u00f4ng c\u1ea7n thao t\u00e1c g\u00ec. M\u1ecdi website l\u01b0u tr\u1eef t\u1ea1i DPS.MEDIA \u0111\u1ec1u \u0111\u01b0\u1ee3c thi\u1ebft l\u1eadp c\u01a1 ch\u1ebf theo d\u00f5i an ninh t\u1ef1 \u0111\u1ed9ng, gi\u00e1m s\u00e1t to\u00e0n v\u1eb9n t\u1ec7p tin 24\/7 v\u00e0 c\u1eadp nh\u1eadt b\u1ea3n v\u00e1 t\u1ef1 \u0111\u1ed9ng ngay khi v\u1eeba ph\u00e1t h\u00e0nh, k\u1ebft h\u1ee3p m\u00f4i tr\u01b0\u1eddng PHP c\u00f4 l\u1eadp tuy\u1ec7t \u0111\u1ed1i.<\/p><p>Tuy nhi\u00ean, v\u1edbi c\u00e1c qu\u1ea3n tr\u1ecb vi\u00ean t\u1ef1 v\u1eadn h\u00e0nh m\u00e1y ch\u1ee7 ri\u00eang ho\u1eb7c d\u00f9ng hosting b\u00ean th\u1ee9 ba, hi\u1ec3u r\u00f5 c\u00e1ch l\u1ed7 h\u1ed5ng ho\u1ea1t \u0111\u1ed9ng s\u1ebd gi\u00fap b\u1ea1n ch\u1ee7 \u0111\u1ed9ng ph\u00f2ng h\u1ed9 tr\u01b0\u1edbc khi c\u00e1c \u0111\u1ee3t qu\u00e9t m\u00e3 \u0111\u1ed9c t\u1ef1 \u0111\u1ed9ng b\u00f9ng ph\u00e1t.<\/p><h2>C\u01a1 ch\u1ebf k\u1ef9 thu\u1eadt: L\u1ed7i gi\u1ea3i m\u00e3 k\u00e9p trong get_page_template()<\/h2><p>L\u1ed7 h\u1ed5ng n\u1eb1m \u1edf c\u00e1ch WordPress l\u1ef1a ch\u1ecdn t\u1ec7p template khi render m\u1ed9t trang web.<\/p><p>K\u1ebb t\u1ea5n c\u00f4ng g\u1eedi m\u1ed9t request \u1ea9n danh t\u1edbi trang m\u1ee5c ti\u00eau v\u1edbi hai tham s\u1ed1 quen thu\u1ed9c:<\/p><ul>\n<li><code class=\"notranslate no-translate\" data-no-translation=\"\">page_id<\/code>: Tr\u1ecf t\u1edbi m\u1ed9t b\u00e0i vi\u1ebft ho\u1eb7c trang h\u1ee3p l\u1ec7 \u0111ang online. Nh\u1edd \u0111\u00f3, WordPress ti\u1ebfp nh\u1eadn request v\u00e0 chu\u1ea9n b\u1ecb tr\u1ea3 v\u1ec1 n\u1ed9i dung nh\u01b0 b\u00ecnh th\u01b0\u1eddng.<\/li>\n<li><code class=\"notranslate no-translate\" data-no-translation=\"\">pagename<\/code>: Ch\u1ee9a chu\u1ed7i duy\u1ec7t th\u01b0 m\u1ee5c (directory traversal) \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a URL hai l\u1ea7n (double-encoded), ch\u1eb3ng h\u1ea1n c\u00e1c chu\u1ed7i nh\u1ea3y l\u00f9i c\u1ea5p th\u01b0 m\u1ee5c nh\u01b0 <code class=\"notranslate no-translate\" data-no-translation=\"\">%252e%252e%252f<\/code>.<\/li>\n<\/ul><p>Khi d\u1ef1ng template, h\u00e0m <code class=\"notranslate no-translate\" data-no-translation=\"\">get_page_template()<\/code> gi\u1ea3i m\u00e3 gi\u00e1 tr\u1ecb tham s\u1ed1 n\u00e0y \u0111\u1ec3 t\u1ea1o \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p. Thao t\u00e1c decode \u0111\u00e3 bi\u1ebfn chu\u1ed7i \u1ea9n th\u00e0nh \u0111\u01b0\u1eddng d\u1eabn th\u1ef1c, khi\u1ebfn traversal \u201cl\u1ecdt qua\u201d b\u1ed9 l\u1ecdc. \u0110\u01b0\u1eddng d\u1eabn template b\u1ecb b\u1ebb h\u01b0\u1edbng ra ngo\u00e0i th\u01b0 m\u1ee5c theme \u0111\u01b0\u1ee3c cho ph\u00e9p, v\u00e0 WordPress s\u1ebd n\u1ea1p (include) b\u1ea5t k\u1ef3 t\u1ec7p PHP n\u00e0o m\u00e0 n\u00f3 t\u00ecm th\u1ea5y tr\u00ean \u0111\u01b0\u1eddng d\u1eabn \u0111\u00f3.<\/p><p>Theo t\u00e0i li\u1ec7u ph\u00e2n t\u00edch t\u1eeb <a href=\"https:\/\/patchstack.com\/articles\/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce\/\" target=\"_blank\" rel=\"noopener nofollow\">Patchstack<\/a>, WordPress tr\u01b0\u1edbc \u0111\u00f3 t\u1eebng ki\u1ec3m tra traversal cho m\u1ed9t tham s\u1ed1 t\u01b0\u01a1ng t\u1ef1 nh\u01b0ng l\u1ea1i b\u1ecf s\u00f3t tham s\u1ed1 n\u00e0y. B\u1ea3n 7.1.2 \u0111\u00e3 b\u1ed5 sung b\u01b0\u1edbc ki\u1ec3m tra v\u00e0 \u00e1p \u0111\u1eb7t quy t\u1eafc m\u1edbi: m\u1ecdi \u0111\u01b0\u1eddng d\u1eabn template sau khi ph\u00e2n gi\u1ea3i b\u1eaft bu\u1ed9c ph\u1ea3i n\u1eb1m g\u1ecdn trong th\u01b0 m\u1ee5c theme cho ph\u00e9p.<\/p><p><img decoding=\"async\" src=\"https:\/\/dps.media\/wp-content\/uploads\/2026\/09\/cve_2026_87902_lo_hong_file_in_img2_1790130166274.png\" alt=\"CVE-2026-87902\" style=\"display:block; margin:20px auto; max-width:100%; height:auto;\" title=\"\"><\/p><h2>\u0110i\u1ec1u ki\u1ec7n k\u00edch ho\u1ea1t: Kh\u00f4ng ph\u1ea3i website n\u00e0o c\u0169ng d\u00ednh RCE<\/h2><p>L\u1ed7 h\u1ed5ng \u0111\u1ea1t \u0111i\u1ec3m CVSS 9.2, nh\u01b0ng \u0111\u1ec3 khai th\u00e1c th\u00e0nh c\u00f4ng \u0111\u00f2i h\u1ecfi nh\u1eefng \u0111i\u1ec1u ki\u1ec7n m\u00f4i tr\u01b0\u1eddng c\u1ee5 th\u1ec3:<\/p><p><strong>1. C\u1ea5u tr\u00fac th\u01b0 m\u1ee5c c\u1ee7a theme:<\/strong> Theme \u0111ang ho\u1ea1t \u0111\u1ed9ng ph\u1ea3i c\u00f3 m\u1ed9t th\u01b0 m\u1ee5c c\u1ea5p cao b\u1eaft \u0111\u1ea7u b\u1eb1ng ti\u1ec1n t\u1ed1 <code class=\"notranslate no-translate\" data-no-translation=\"\">page-<\/code>, \u0111i\u1ec3n h\u00ecnh l\u00e0 <code class=\"notranslate no-translate\" data-no-translation=\"\">page-templates\/<\/code>. \u0110\u00e1ng ch\u00fa \u00fd, \u0111\u00e2y t\u1eebng l\u00e0 c\u1ea5u tr\u00fac \u0111\u01b0\u1ee3c ch\u00ednh t\u00e0i li\u1ec7u c\u1ee7a WordPress khuy\u1ebfn ngh\u1ecb. C\u00e1c theme m\u1eb7c \u0111\u1ecbnh g\u1ea7n \u0111\u00e2y (Twenty Twenty-Three, Twenty Twenty-Four, Twenty Twenty-Five) kh\u00f4ng d\u00f9ng c\u1ea5u tr\u00fac n\u00e0y, nh\u01b0ng r\u1ea5t nhi\u1ec1u theme c\u0169 v\u00e0 theme b\u00ean th\u1ee9 ba tr\u00ean ThemeForest v\u1eabn \u0111ang s\u1eed d\u1ee5ng.<\/p><p><strong>2. \u0110i\u1ec1u ki\u1ec7n leo thang t\u1eeb LFI l\u00ean RCE:<\/strong> Ch\u1ec9 \u0111\u1ecdc t\u1ec7p PHP th\u00f4i th\u00ec ch\u01b0a \u0111\u1ee7 \u0111\u1ec3 chi\u1ebfm quy\u1ec1n m\u00e1y ch\u1ee7. Trong c\u00e1c b\u00e0i lab th\u1ef1c nghi\u1ec7m c\u1ee7a Robert Ressl, chu\u1ed7i khai th\u00e1c leo thang l\u00ean th\u1ef1c thi m\u00e3 t\u1eeb xa c\u1ea7n th\u00eam ba y\u1ebfu t\u1ed1:<\/p><ul>\n<li>S\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a c\u00e1c t\u1ec7p PEAR (v\u1ed1n c\u00f3 s\u1eb5n trong Docker image ch\u00ednh th\u1ee9c c\u1ee7a WordPress).<\/li>\n<li>Ch\u1ec9 th\u1ecb <code class=\"notranslate no-translate\" data-no-translation=\"\">register_argc_argv<\/code> \u0111\u01b0\u1ee3c b\u1eadt trong c\u1ea5u h\u00ecnh PHP (m\u1eb7c \u0111\u1ecbnh b\u1eadt tr\u00ean official PHP Docker image v\u00e0 cPanel ch\u1ea1y PHP d\u01b0\u1edbi 8.5).<\/li>\n<li>M\u1ed9t th\u01b0 m\u1ee5c tr\u00ean m\u00e1y ch\u1ee7 cho ph\u00e9p ti\u1ebfn tr\u00ecnh web ghi t\u1ec7p.<\/li>\n<\/ul><p>Khi \u0111\u1ee7 c\u00e1c \u0111i\u1ec1u ki\u1ec7n n\u00e0y, m\u00e3 th\u1ef1c thi s\u1ebd ch\u1ea1y v\u1edbi quy\u1ec1n c\u1ee7a t\u00e0i kho\u1ea3n web server (<code class=\"notranslate no-translate\" data-no-translation=\"\">www-data<\/code> ho\u1eb7c user hosting). K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 \u0111\u1ecdc n\u1ed9i dung t\u1ec7p <code class=\"notranslate no-translate\" data-no-translation=\"\">wp-config.php<\/code> \u0111\u1ec3 l\u1ea5y th\u00f4ng tin k\u1ebft n\u1ed1i c\u01a1 s\u1edf d\u1eef li\u1ec7u, s\u1eeda \u0111\u1ed5i b\u00e0i vi\u1ebft ho\u1eb7c ch\u00e8n webshell.<\/p><h2>H\u1ed3i chu\u00f4ng c\u1ea3nh b\u00e1o t\u1eeb chu\u1ed7i l\u1ed7 h\u1ed5ng Core d\u1ed3n d\u1eadp<\/h2><p>CVE-2026-87902 l\u00e0 l\u1ed7 h\u1ed5ng c\u1ed1t l\u00f5i th\u1ee9 ba li\u00ean ti\u1ebfp c\u1ee7a WordPress xu\u1ea5t hi\u1ec7n g\u1ea7n \u0111\u00e2y:<\/p><ul>\n<li><strong>wp2shell (Th\u00e1ng 7\/2026):<\/strong> Chu\u1ed7i l\u1ed7 h\u1ed5ng no-login code execution g\u1ed3m CVE-2026-63030 v\u00e0 CVE-2026-60137, \u0111\u00e3 b\u1ecb CISA \u0111\u01b0a v\u00e0o danh m\u1ee5c KEV (l\u1ed7 h\u1ed5ng \u0111ang b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c).<\/li>\n<li><strong>XSS2Shell (Th\u00e1ng 8\/2026):<\/strong> L\u1ed7 h\u1ed5ng CVE-2026-64638 tr\u00ean b\u1ea3n 7.0.3, bi\u1ebfn m\u1ed9t l\u1ea7n \u0111\u0103ng nh\u1eadp sai th\u00e0nh m\u00e3 JavaScript \u0111\u1ed9c h\u1ea1i do k\u1ebb t\u1ea5n c\u00f4ng \u0111i\u1ec1u khi\u1ec3n.<\/li>\n<li><strong>Click2Shell:<\/strong> V\u1eeba \u0111\u01b0\u1ee3c kh\u1eafc ph\u1ee5c trong b\u1ea3n 7.1.1 nh\u1eb1m ng\u0103n ch\u1eb7n vi\u1ec7c l\u1eeba tr\u00ecnh duy\u1ec7t c\u1ee7a qu\u1ea3n tr\u1ecb vi\u00ean t\u1ef1 \u0111\u1ed9ng c\u00e0i \u0111\u1eb7t theme ch\u1ee9a m\u00e3 \u0111\u1ed9c.<\/li>\n<\/ul><p>Vi\u1ec7c c\u00e1c l\u1ed7 h\u1ed5ng core li\u00ean ti\u1ebfp b\u1ecb ph\u00e1t hi\u1ec7n cho th\u1ea5y gi\u1edbi b\u1ea3o m\u1eadt \u0111ang r\u00e0 so\u00e1t r\u1ea5t s\u00e2u v\u00e0o c\u00e1c logic x\u1eed l\u00fd c\u0169 c\u1ee7a WordPress. \u0110i\u1ec3m \u0111\u00e1ng m\u1eebng l\u00e0 nh\u00e0 nghi\u00ean c\u1ee9u Robert Ressl \u0111\u00e3 tu\u00e2n th\u1ee7 quy tr\u00ecnh c\u00f4ng b\u1ed1 c\u00f3 tr\u00e1ch nhi\u1ec7m (responsible disclosure) v\u00e0 hi\u1ec7n ch\u01b0a ghi nh\u1eadn v\u1ee5 t\u1ea5n c\u00f4ng th\u1ef1c t\u1ebf n\u00e0o. D\u00f9 v\u1eady, do PoC \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00f4ng khai tr\u00ean GitHub, th\u1eddi gian \u0111\u1ec3 c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng chuy\u1ec3n \u0111\u1ed5i th\u00e0nh bot qu\u00e9t t\u1ef1 \u0111\u1ed9ng ch\u1ec9 t\u00ednh b\u1eb1ng ng\u00e0y.<\/p><h2>Khuy\u1ebfn ngh\u1ecb c\u1eadp nh\u1eadt v\u00e0 bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u r\u1ee7i ro<\/h2><p>N\u1ebfu b\u1ea1n \u0111ang t\u1ef1 qu\u1ea3n l\u00fd website, h\u00e3y th\u1ef1c hi\u1ec7n ngay c\u00e1c b\u01b0\u1edbc sau:<\/p><h3>1. C\u1eadp nh\u1eadt WordPress l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t<\/h3><p>H\u00e3y c\u1eadp nh\u1eadt ngay l\u00ean <strong>WordPress 7.1.2<\/strong>. \u0110\u1ed9i ng\u0169 WordPress c\u0169ng \u0111\u00e3 cung c\u1ea5p b\u1ea3n v\u00e1 h\u1ed3i t\u1ed1 cho c\u00e1c nh\u00e1nh c\u0169: <code class=\"notranslate no-translate\" data-no-translation=\"\">7.0.6<\/code>, <code class=\"notranslate no-translate\" data-no-translation=\"\">6.9.9<\/code>, <code class=\"notranslate no-translate\" data-no-translation=\"\">6.8.10<\/code>\u2026 tr\u1ea3i d\u00e0i t\u1edbi nh\u00e1nh <code class=\"notranslate no-translate\" data-no-translation=\"\">4.7.37<\/code> theo th\u00f4ng b\u00e1o ch\u00ednh th\u1ee9c t\u1ea1i <a href=\"https:\/\/wordpress.org\/news\/2026\/09\/wordpress-7-1-2-release\/\" target=\"_blank\" rel=\"noopener nofollow\">WordPress.org Release Announcement<\/a>. C\u00e1c website b\u1eadt t\u00ednh n\u0103ng c\u1eadp nh\u1eadt ng\u1ea7m s\u1ebd t\u1ef1 \u0111\u1ed9ng nh\u1eadn b\u1ea3n v\u00e1.<\/p><h3>2. Bi\u1ec7n ph\u00e1p t\u1ea1m th\u1eddi n\u1ebfu ch\u01b0a th\u1ec3 c\u1eadp nh\u1eadt ngay<\/h3><p>Tr\u01b0\u1eddng h\u1ee3p website ph\u1ee5 thu\u1ed9c nhi\u1ec1u plugin t\u00f9y bi\u1ebfn v\u00e0 c\u1ea7n th\u1eddi gian ki\u1ec3m th\u1eed tr\u01b0\u1edbc khi n\u00e2ng c\u1ea5p, h\u00e3y \u00e1p d\u1ee5ng ngay c\u00e1c gi\u1ea3i ph\u00e1p t\u00ecnh th\u1ebf:<\/p><ul>\n<li>T\u1eaft directive <code class=\"notranslate no-translate\" data-no-translation=\"\">register_argc_argv = Off<\/code> trong t\u1ec7p <code class=\"notranslate no-translate\" data-no-translation=\"\">php.ini<\/code> cho c\u00e1c web request. \u0110\u00e2y l\u00e0 n\u00fat th\u1eaft ch\u1eb7n \u0111\u1ee9ng kh\u1ea3 n\u0103ng bi\u1ebfn LFI th\u00e0nh RCE.<\/li>\n<li>X\u00f3a ho\u1eb7c v\u00f4 hi\u1ec7u h\u00f3a c\u00e1c t\u1ec7p PEAR kh\u00f4ng c\u1ea7n thi\u1ebft trong th\u01b0 m\u1ee5c PHP \/ Docker container.<\/li>\n<li>Si\u1ebft ch\u1eb7t quy\u1ec1n ghi th\u01b0 m\u1ee5c \u0111\u1ed1i v\u1edbi ti\u1ebfn tr\u00ecnh PHP (<code class=\"notranslate no-translate\" data-no-translation=\"\">chmod 755<\/code> cho folder v\u00e0 <code class=\"notranslate no-translate\" data-no-translation=\"\">chmod 644<\/code> cho file).<\/li>\n<\/ul><p>C\u1ea7n l\u01b0u \u00fd: C\u00e1c bi\u1ec7n ph\u00e1p c\u1ea5u h\u00ecnh tr\u00ean ch\u1ec9 mang t\u00ednh gi\u1ea3m thi\u1ec3u b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng t\u1ea1m th\u1eddi, kh\u00f4ng thay th\u1ebf \u0111\u01b0\u1ee3c b\u1ea3n v\u00e1 m\u00e3 ngu\u1ed3n ch\u00ednh th\u1ee9c.<\/p><p><img decoding=\"async\" src=\"https:\/\/dps.media\/wp-content\/uploads\/2026\/09\/cve_2026_87902_lo_hong_file_in_img3_1790130267203.png\" alt=\"CVE-2026-87902\" style=\"display:block; margin:20px auto; max-width:100%; height:auto;\" title=\"\"><\/p><h2>An t\u00e2m v\u1eadn h\u00e0nh h\u1ec7 th\u1ed1ng c\u00f9ng DPS.MEDIA<\/h2><p>T\u1ea1i DPS.MEDIA, b\u1ea3o m\u1eadt h\u1ea1 t\u1ea7ng l\u00e0 ti\u00eau chu\u1ea9n m\u1eb7c \u0111\u1ecbnh cho m\u1ecdi d\u1ef1 \u00e1n. T\u1ea5t c\u1ea3 kh\u00e1ch h\u00e0ng s\u1eed d\u1ee5ng d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef v\u00e0 qu\u1ea3n tr\u1ecb website c\u1ee7a ch\u00fang t\u00f4i lu\u00f4n \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 b\u1edfi:<\/p><ul>\n<li>H\u1ec7 th\u1ed1ng m\u00e1y ch\u1ee7 ph\u00e2n v\u00f9ng \u0111\u1ed9c l\u1eadp, c\u00e1ch ly t\u00e0i nguy\u00ean v\u00e0 ch\u1eb7n tri\u1ec7t \u0111\u1ec3 c\u00e1c h\u00e0nh vi directory traversal \u1edf t\u1ea7ng WAF.<\/li>\n<li>Quy tr\u00ecnh t\u1ef1 \u0111\u1ed9ng theo d\u00f5i, v\u00e1 l\u1ed7i an ninh ngay khi ph\u00e1t h\u00e0nh m\u00e0 kh\u00f4ng l\u00e0m gi\u00e1n \u0111o\u1ea1n tr\u1ea3i nghi\u1ec7m c\u1ee7a ng\u01b0\u1eddi d\u00f9ng truy c\u1eadp.<\/li>\n<li>\u0110\u1ed9i ng\u0169 k\u1ef9 s\u01b0 t\u00fac tr\u1ef1c r\u00e0 so\u00e1t m\u00e3 \u0111\u1ed9c v\u00e0 sao l\u01b0u d\u1eef li\u1ec7u \u0111a \u0111i\u1ec3m h\u1eb1ng ng\u00e0y.<\/li>\n<\/ul><p>N\u1ebfu b\u1ea1n c\u1ea7n h\u1ed7 tr\u1ee3 ki\u1ec3m tra an ninh website ho\u1eb7c n\u00e2ng c\u1ea5p h\u1ec7 th\u1ed1ng h\u1ea1 t\u1ea7ng an to\u00e0n, h\u00e3y li\u00ean h\u1ec7 ngay v\u1edbi DPS.MEDIA \u0111\u1ec3 \u0111\u01b0\u1ee3c gi\u1ea3i \u0111\u00e1p chi ti\u1ebft.<\/p><div class=\"dps-contact-box\" style=\"margin-top: 30px; padding: 20px; background: #f8fafc; border-left: 4px solid #32b561; border-radius: 8px;\">\n<p style=\"margin: 0 0 8px 0; font-weight: bold; font-size: 16px; color: #151577;\">DPS.MEDIA\u80a1\u4efd\u516c\u53f8<\/p>\n<p style=\"margin: 0 0 6px 0;\">\ud83d\udccd <strong>\u5730\u5740\uff1a<\/strong> \u80e1\u5fd7\u660e\u5e02\u65b0\u5b9a\u574a\u962e\u5ef7\u662d\u885756\u53f7<\/p>\n<p style=\"margin: 0 0 6px 0;\">\ud83d\udcde <strong>\u70ed\u7ebf \/ Zalo:<\/strong> <a href=\"tel:0961545445\" style=\"color: #32b561; font-weight: bold;\">0961 545 445<\/a><\/p>\n<p style=\"margin: 0 0 6px 0;\">\u2709 <strong>\u7535\u5b50\u90ae\u4ef6:<\/strong> <a href=\"mailto:marketing@dps.media\">marketing@dps.media<\/a><\/p>\n<p style=\"margin: 0 0 6px 0;\">\ud83c\udf10 <strong>\u7f51\u7ad9\uff1a<\/strong> <a href=\"https:\/\/dps.media\/zh\/\" target=\"_blank\" rel=\"noopener\">https:\/\/dps.media<\/a><\/p>\n<p style=\"margin: 0;\">\ud83c\udfe2 <strong>\u7a0e\u53f7\uff1a<\/strong> 0318700500 | <strong>VCB\uff1a<\/strong> 1051160909<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Ph\u00e2n t\u00edch chi ti\u1ebft l\u1ed7 h\u1ed5ng CVE-2026-87902 (CVSS 9.2) tr\u00ean WordPress core, c\u01a1 ch\u1ebf khai th\u00e1c File Inclusion leo thang RCE v\u00e0 gi\u1ea3i ph\u00e1p b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng website.<\/p>","protected":false},"author":0,"featured_media":40867,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1724,2479,70],"tags":[675],"class_list":["post-40870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cong-nghe","category-thiet-ke-web","category-tin-tuc","tag-dps-media"],"acf":[],"rankmath_keywords":{"primary":"CVE-2026-87902, l\u1ed7 h\u1ed5ng WordPress 7.1.2, WordPress File Inclusion RCE, l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026, c\u1eadp nh\u1eadt WordPress 7.1.2","secondary":["l\u1ed7 h\u1ed5ng WordPress 7.1.2","WordPress File Inclusion RCE","l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026","c\u1eadp nh\u1eadt WordPress 7.1.2"]},"yoast_keywords":{"primary":"","secondary":[]},"yoast_focuskw":"","rankmath_focuskw":"CVE-2026-87902, l\u1ed7 h\u1ed5ng WordPress 7.1.2, WordPress File Inclusion RCE, l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026, c\u1eadp nh\u1eadt WordPress 7.1.2","seo_keywords":{"primary":"CVE-2026-87902, l\u1ed7 h\u1ed5ng WordPress 7.1.2, WordPress File Inclusion RCE, l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026, c\u1eadp nh\u1eadt WordPress 7.1.2","secondary":["l\u1ed7 h\u1ed5ng WordPress 7.1.2","WordPress File Inclusion RCE","l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026","c\u1eadp nh\u1eadt WordPress 7.1.2"]},"_links":{"self":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/posts\/40870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/comments?post=40870"}],"version-history":[{"count":0,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/posts\/40870\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/media\/40867"}],"wp:attachment":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/media?parent=40870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/categories?post=40870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/tags?post=40870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}