Protože hodně operátorů má weby na WordPressu, vyplatí se neprodleně upgradovat.
Včera odpoledne vyšla bezpečnostní verze 6.9.2
Dnes nad ránem bez bližších informací 6.4.8 / 6.5.8 / 6.6.5 / 6.7.5 / 6.8.5
Fixy ve verzi 6.9.2
- A Blind SSRF issue reported by sibwtf, and subsequently by several other researchers while the fix was being worked on
- A PoP-chain weakness in the HTML API and Block Registry reported by Phat RiO
- A regex DoS weakness in numeric character references reported by Dennis Snell of the WordPress Security Team
- A stored XSS in nav menus reported by Phill Savage
- An AJAX query-attachments authorization bypass reported by Vitaly Simonovich
- A stored XSS via the data-wp-bind directive reported by kaminuma
- An XSS that allows overridding client-side templates in the admin area reported by Asaf Mozes
- A PclZip path traversal issue reported independently by Francesco Carlucci and kaminuma
- An authorization bypass on the Notes feature reported by kaminuma
- An XXE in the external getID3 library reported by Youssef Achtatal
