5.5.3:
This maintenance release fixes an issue introduced in WordPress 5.5.2
which makes it impossible to install WordPress on a brand new website
that does not have an existing database connection configuration.
This release does not affect sites where a database connection is
already configured, for example, via one-click installers or
an existing wp-config.php file.
5.5.2:
Security updates:
- Props to Alex Concha of the WordPress Security Team for their work in hardening deserialization requests.
- Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network.
- Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables.
- Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC.
- Props to Omar Ganiev who reported a method where a DoS attack could lead to RCE.
- Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs.
- Thanks to Slavco for reporting, and confirmation from Karim El Ouerghemmi, a method to bypass protected meta that could lead to arbitrary file deletion.
- And a special thanks to @zieladam who was integral in many of the releases and patches during this release.
Maintenance updates:
#51130 Events displayed in venue timezone instead of user’s
#51659 Update Gutenberg Dependencies for WordPress 5.5.2
#50861 Remove Facebook and Instagram as an oEmbed Source
#50903 Set the local environment to a development environment type by default
#50949 Posts show wrong time when user is in a different time zone than the site’s
#51053 Video Embeds set to align left disappear in Gutenberg editor
#51175 Wrong reply box title
#51219 Theme editor page showing undefined variable notice
#51251 Fix PHP notice when opening the edit image popup
#51263 PHP warning when editing comments in the administration comment edit screen
#51320 PHP Notice while moving post to trash (post_type has 2 registered taxonomies both with default_term set)
#51400 Undefined index during automatic plugin/theme updates
#51595 Unable to make anonymous comments via XML-RPC
#51645 Undefined index: echo in core files
Changes:
5.5:
- lazy-loaded images
- new sitemap
- autoupdate of plugins and themes
- block editor:
- block patterns
- block directory
- inline image editing
5.5.1:
WordPress Core changes on Trac:
#50882 - Administration: WP 5.5: Cannot attribute content when deleting users
#50998 - Quick/Bulk Edit: Editing posts using bottom "Bulk actions" dropdown menu doesn't work
#38009 - Comments: #reply-title.comment-reply-title not updating when replying to an individual
#50845 - Editor: Block patterns: Fix translatable strings (take 2)
#50858 - Site Health: Check PHP notices with site_status_tests filter
#50887 - Site Health: Add site environment to debug information
#50892 - Editor: Some block patterns have text contrast issues with dark themes
#50910 - Sitemaps: 5.5 Sitemap URLs are incorrectly paginated
#50912 - Site Health: flags define WP_AUTO_UPDATE_CORE value as an error
#50919 - Script Loader: Change the jquery handle back to an alias for jquery-core
#50933 - Media: Lazy loading in 5.5 causes flashing of custom logo in Firefox
#50945 - Site Health: don't give a warning when upload_max_size is lower than max_post_size
#50988 - Upgrade/Install: Pass details about the specific plugin and theme updates attempted to filters
#50992 - Bootstrap/Load: Remove the ability to alter the list of environment types in wp_get_environment_type()
#50999 - Script Loader: Disable concatenation for scripts with translations to ensure they are printed in the right order
#51011 - Upgrade/Install: Empty string comparison on home option during DB upgrades is invalid
#51018 - Editor: PHP Notice thrown when searching for certain terms via the Gutenberg block directory
#51151 - Editor: Packages update
#51021 - REST API: Permit uniqueItems keyword in endpoint args
#51146 - REST API: Fix multi-type schemas with integer fields
#51029 - Filesystem API: Typo in variable name causes warning from fclose()
#51042 - Post: missing excerpt
#51050 - Docs: Add docblock for get_the_archive_title() filter
#51052 - Administration: Undefined index: update-supported
#51060 - Docs: Update register_rest_route docblock to reflect additions since 5.5
#51064 - Bootstrap/Load: Consider adding "local" as environment on WP_ENVIRONMENT_TYPE
#51073 - Administration: Extra padding below the admin bar
#51075 - Docs: Update docs for custom logo functions
#51122 - Docs: add a mention about the use of loading attribute in wp_get_attachment_image function
#51127 - UI/CSS: Remove non-color related styling from Modern color scheme
#51129 - Upgrade/Install: Only display the auto-update links on the Network Admin > Themes screen for themes that support the feature
#51337 - Template: wp_terms_checklist not checking selected taxonomy items with selected_cats option
#51184 - get_the_date() checks $format only for empty variable and fails on false boolean
#51182 - Theme_Installer_skin::do_overwrite does not work on a Windows server
#38009 - #reply-title.comment-reply-title not updating when replying to an individual
#51123 - commonL10n and other JS globals removed without backwards compatibility
#50848 - Clarify the usage of null for auto_update_{$type} filter
#51081 - Fatal Error - Undefined get_page_templates() in Customizer
#51154 - sitemaps should be initialized before each test is run
#51028 - Dot should be out of the quotes
Block editor changes from GitHub:
PR24609 - Fix missing selected block highlighting in list view
PR24599 - Fix specificity for buttons with outline style and background colors
PR24533 - Fix incorrect aria description in List View
PR24516 - Fix regression bug for category select in QueryControls component
PR24478 - Fix tiny editor preview when using Mobile or Tablet options with metaboxes enabled
Changes:
WordPress versions 5.4 and earlier are affected by the following bugs, which are fixed in version 5.4.2. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.
- Props to Sam Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low privileges are able to add JavaScript to posts in the block editor.
- Props to Luigi – (gubello.me) for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files.
- Props to Ben Bidner of the WordPress Security Team for finding an open redirect issue in wp_validate_redirect().
- Props to Nrimo Ing Pandum for finding an authenticated XSS issue via theme uploads.
- Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation.
- Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.
Thank you to all of the reporters for privately disclosing the vulnerabilities. This gave the security team time to fix the vulnerabilities before WordPress sites could be attacked.
More details on https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
Changes for 5.4:
Too much to include here, visit https://wordpress.org/support/wordpress-version/version-5-4/
Changes for 5.4.1:
Six security issues affect WordPress versions 5.4 and earlier; version 5.4.1 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.4, there are also updated versions of 5.3 and earlier that fix the security issues.
- Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated
- Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated
- Props to Evan Ricafort for discovering an XSS issue in the Customizer
- Props to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block
- Props to Nick Daugherty from WPVIP.com / WordPress Security Team who discovered an XSS issue in wp-object-cache
- Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.
- Additionally, an authenticated XSS issue in the block editor was discovered by Nguyen the Duc in WordPress 5.4 RC1 and RC2. It was fixed in 5.4 RC5. We wanted to be sure to give credit and thank them for all of their work in making WordPress more secure.
WordPress 5.4.1 also fixes some regressions introduced in version 5.4:
#49838 – Accessibility: Fix the headings hierarchy on the Freedoms page
#49798 – Customize: Give the WordPress logo a white background for dark mode browsers
#49853 – Mail: Make the check for empty post title in wp-mail.php more resilient
#49753 – Media: Remove display: none; from the (visually hidden) <input type="file"> button used in Plupload to select files for uploading. Fixes selecting files in Edge <= 44 and iOS Safari
#49772 – Privacy: Support additional elements (table, ol, ul) in privacy policy guide new styling
#49802 – Privacy: Make the deprecated wp_get_user_request_data() function available on front end
#49645 – REST API: Fix revisions controller get_item permission check
#49648 – REST API: Fix _fields filtering of registered rest fields
#49824 – Site Health: Instantiation prevents use of some hooks by plugins
#49759 – Taxonomy: Un-deprecate category_link and tag_link filters
#49974 – Block Editor updates
Changes:
Version 5.3.2:
Maintenance updates
- Date/Time: Ensure that get_feed_build_date() correctly handles a modified post object with invalid date.
- Uploads: Fix file name collision in wp_unique_filename() when uploading a file with upper case extension on non case-sensitive file systems.
- Media: Fix PHP warnings in wp_unique_filename() when the destination directory is unreadable.
- Administration: Fix the colors in all color schemes for buttons with the .active class.
- Tests/build tools: In wp_insert_post(), when checking the post date to set future or publish status, use a proper delta comparison.
Version 5.3.1:
Security fixes
- Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
- Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.
- Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.
- Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.
Maintenance updates
- Administration: improvements to admin form controls height and alignment standardization (see related dev note), dashboard widget links accessibility and alternate color scheme readability issues (see related dev note).
- Block editor: fix Edge scrolling issues and intermittent JavaScript issues.
- Bundled themes: add customizer option to show/hide author bio, replace JS based smooth scroll with CSS (see related dev note) and fix Instagram embed CSS.
- Date/time: improve non-GMT dates calculation, fix date format output in specific languages and make get_permalink() more resilient against PHP timezone changes.
- Embeds: remove CollegeHumor oEmbed provider as the service doesn’t exist anymore.
- External libraries: update sodium_compat.
- Site health: allow the remind interval for the admin email verification to be filtered.
- Uploads: avoid thumbnails overwriting other uploads when filename matches, and exclude PNG images from scaling after upload.
- Users: ensure administration email verification uses the user’s locale instead of the site locale.
Changes:
5.2.4:
Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer.
Props to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.
Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript into style tags.
Props to David Newman for highlighting a method to poison the cache of JSON GET requests via the Vary: Origin header.
Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs are validated.
Props to Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin.
5.2.3:
#38415: New Custom Link menu item has a wrong fallback label
#45739: Block Editor: $editor_styles bug.
#45935: A URL in do_block_editor_incompatible_meta_box function does not have classic-editor__forget parameter
#46757: Media Trash: The Bulk Media options when in the Trash shouldn’t provide two primary buttons
#46758: Media Trash: Primary button(s) should be on the left
#46899: Ensure that tables generated by the Settings API have no semantics
#47079: Incorrect version for excerpt_allowed_blocks filter
#47113: Media views: dismiss notice button is invisible
#47145: Feature Image dialog does not follow the dialog pattern
#47190: Twenty Seventeen: Native audio and video embeds have no focus state.
#47340: Twenty Nineteen: Revise Latest Posts block styles to support post content options.
#47386: Fix headings hierarchy in the legacy Custom Background and Custom Header pages
#47390: Improve accessibility of forms elements within some “form-table” forms
#47414: Twenty Seventeen: Button block preview has extra spacing within button
#47458: Fix tab sequence order in the Media attachment browser
#47489: Emoji are substituted in preformatted blocks
#47502: Media modal bottom toolbar cuts-off content in Internet Explorer 11
#47538: Minor Verbiage Update – Switch ‘developer time’ for ‘a developer’
#47543: Twenty Seventeen: buttons don’t change color on hover and focus
#47561: Plugin: View details popup layout issue
#47603: My account toggle on admin bar not visible at high zoom levels
#47604: Undefined variable: locked in wp-admin/edit-form-blocks.php
#47687: Use alt tags for gallery images in editor
#47688: Color hex code in color picker displayed in RTL instead of LTR on RTL install (take 2)
#47693: customizer Color picker should get closed when click on color picker area.
#47723: Adding a custom link in nav-menus.php doesn’t trim whitespace
#47758: Font sizes on installation screen are too small
#47835: PHP requirement always set to null for plugins
#47888: Adding a custom link in menu via Customize doesn’t trim whitespace.
Security Fixes
Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.
Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.
Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.
Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability that for cross-site scripting (XSS) in shortcode previews.
Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.
Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.
In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.
5.2:
- Site Health
- PHP Error Protection
- Accessibility Updates
- New Dashboard Icons
- Plugin Compatibility Checks
- Privacy Updates
- New Body Hook
- Building JavaScript
5.2.1:
- 47180: An issue typing in the block editor while using a RTL language
has been fixed.
- 47186: An bug causing 32-bit systems to run out of memory when using
sodium_compat was fixed.
- 47189: The "Update your plugins" link in Site Health now links to the
correct page in multisite installs.
- 47185: An issue in wp_delete_file_from_directory() where files were
not deleting on Windows systems has been fixed.
- 47205: A bug was fixed where spaces could not be added in the Classic
Editor after pressing shift+enter.
- 47265: 2 fatal errors on the error protection page when a PHP error
was encountered in a drop-in (such as advanced-cache.php) were fixed.
- 47244: wp_targeted_link_rel() has been improved to prevent instances
where single and double quotation marks were incorrectly staggered.
- 47169: PHP/MySQL minimum version requirement checks now return proper
error codes when requirements are not met in test environments.
- 47177: The backwards compatibility of get_search_form() was improved.
- 47297: The accuracy of the HTTP requests test in Site Health was improved.
- 47229: TinyMCE has been updated to version 4.9.4.
- 47323: Prevents a fatal error that occurs when upgrading to 5.2.1 from
WordPress < 5.2.
- 47304: Fixes a regression that can affect the accuracy of
<lastBuildDate> in feeds.
- 47312: Changes the string used on the About page for 5.2.1 to one that
is already translated.
5.2.2:
- 45094: Dashboard elements don't always have clear focus states, tab order
- 46289: RTL Bug – wrong navigation arrows in media modal
- 46749: Extra border is displaying at bottom of Help section in Firefox
(Responsive : 778 * 841)
- 46881: Site Health: improve the header elements horizontal centering
- 46957: Site Health: Make site health page access be filterable
- 46960: Site Health: Table design issue in small devices (iphone 5/SE).
- 46997: Theme update links show in Customizer and don't work
- 47070: Recovery Mode Exit button not visible in responsive view
- 47158: Merge similar strings introduced in WP 5.2
- 47227: I18n: Merge similar translation strings – site health tabs
- 47475: I18n: Merge similar strings and fix typo
- 47429: Editor: Update packages for WordPress 5.2.2
- 47457: Fix the mediaelements player controls bar sizing
On December 6, 2018, WordPress Version 5.0, named for jazz musician Bebo,
was released to the public. WordPress 5.0 will revolutionize content editing
with introduction of a new block editor and block editor-compatible default
theme Twenty Nineteen.
More infomations at https://wordpress.org/support/wordpress-version/version-5-0/
Upstream changes:
WordPress 4.9.7 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.
WordPress versions 4.9.6 and earlier are affected by a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads directory.
Thank you to Slavco for reporting the original issue and Matt Barry for reporting related issues.
Seventeen other bugs were fixed in WordPress 4.9.7. Particularly of note were:
Taxonomy: Improve cache handling for term queries.
Posts, Post Types: Clear post password cookie when logging out.
Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.
Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.
Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.
Performing substitutions during post-patch breaks tools such as mkpatches,
making it very difficult to regenerate correct patches after making changes,
and often leading to substituted string replacements being committed.
This maintenance release fixes 28 bugs in 4.9, including fixes for Customizer, media library, error notices, and some security fixes. Twenty Seventeen bundled theme and Hello Dolly bundled plugin have also been updated.
WordPress versions 4.9.4 and earlier are affected by three security issues.
More changes at https://codex.wordpress.org/Version_4.9.5.
CHanges:
XSS fixed in the Flash fallback files in MediaElement 4.x.
Bundled Theme
#42820 - Twenty Seventeen -watch that language
Customize
#42492 - Selecting menu location changes line height
#42871 - Features box textstrings in Feature Filter area need new linebreak
Database
#42812 - Use MySQLi when available by default
Editor
#42664 - Editor link autocomplete suggestions: no fallback title displayed for posts with no title
#43012 - Cannot Update Post in Firefox Due to Editor and TinyMCE JavaScript TypeErrors
External Libraries
#42439 - Update random_compat external library for PHP 7 linting failure
Formatting
#42578 - PHP functions inside <p> tags creates new <p> tag, breaking the parent tag into two.
Media
#42225 - Whitelist Flac Files
#42447 - Mark test_remove_orientation_data_on_rotate as skipped when exif_read_data isn't available
#42480 - Consistent suppression of `getimagesize()` errors
#42720 - Remove unnecessary MediaElement.js files
Plugins
#43082 - Add plugins search results: the plugin details modal opens in the thickbox modal
REST API
#42828 - Hard-coded 403 status in REST response should use `rest_authorization_required_code()`
Taxonomy
#42771 - WP_Term::get_instance() regression for non-category terms queried with 'category' taxonomy
#42605 - category_description() does not work properly since 4.9
#42717 - get_category_link() accepting object but not id
TinyMCE
#42416 - Code assumes iframe mode, exception in inline mode
Upgrade/Install
#42963 - Improve deletion of $_old_files during upgrades
Widgets
#42603 - Widgets Warning after activating theme and on dashboard widgets page
#42719 - Always attempt to restore widgets' previous assignment
#42867 - HTML Widget: toggleClass() should be passed true/false as second param
WordPress versions 4.8.2 and earlier are affected by an issue where
$wpdb->prepare() can create unexpected and unsafe queries leading to potential
SQL injection (SQLi). WordPress core is not directly vulnerable to this issue,
but we’ve added hardening to prevent plugins and themes from accidentally
causing a vulnerability. Reported by Anthony Ferrara.
Security issues:
- $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Slavco.
- A cross-site scripting (XSS) vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team.
- A cross-site scripting (XSS) vulnerability was discovered in the visual editor. Reported by Rodolfo Assis (@brutelogic) of Sucuri Security.
- A path traversal vulnerability was discovered in the file unzipping code. Reported by Alex Chapman (noxrnet).
- A cross-site scripting (XSS) vulnerability was discovered in the plugin editor. Reported by 陈瑞琦 (Chen Ruiqi).
- An open redirect was discovered on the user and term edit screens. Reported by Yasin Soliman (ysx).
- A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team.
- A cross-site scripting (XSS) vulnerability was discovered in template names. Reported by Luka (sikic).
- A cross-site scripting (XSS) vulnerability was discovered in the link modal. Reported by Anas Roubi (qasuar).
And 6 other fixes:
* Emoji
- #41584 - Upgrade Twemoji to 2.5.0
- #41852 - Fix UN flag test by returning the correct value.
*I18N
- #41794 - Support numbers in locales during installation
* Security
- #13377 - Add more sanitization in _cleanup_header_comment
*Widgets
- #41596 - New Text Widget recognizes HTML but does not render it in the front end
- #41622 - Text widget can show DOMDocument::loadHTML() warnings in admin when is_legacy_widget method is called
More on https://codex.wordpress.org/Version_4.8.2
WordPress 4.8.1 contains 29 maintenance fixes and enhancements to the 4.8 release series, chief among them are fixes to the rich Text widget and the introduction of the Custom HTML widget.
Administration
* #40982 - Permalink Settings: custom structure field keyboard trap
Build/Test Tools
* #41327 - Bump Akismet External - 4.9 Edition
Comments
* #40975 - 'Empty Spam' and 'Empty Trash' comment buttons not displayed on mobile
Customize
* #40978 - Customizer Panel Footer border missing
* #40981 - Customizer: Menus: it is far too easy to mistakenly delete a menu because the "Delete Menu" link and the "Add Items" button are too close together
* #41158 - Increase tinymce panel z-index
* #41410 - Set `'filter' => 'content'` on starter content "business info" widget
Embeds
* #41019 - oEmbed: Update VideoPress oEmbed URL
* #41048 - `WP_oEmbed_Controller::get_proxy_item()` should remove `_wpnonce` from cached `$args`
* #41299 - oEmbed proxy fails to forward maxwidth and maxheight params
General
* #41056 - WP-API JS Client: Settings is incorrectly registered as a collection
Media
* #41231 - media-views.js: Cannot read .length of undefined (this.controller.$uploaderToggler.length)
REST API
* #38964 - Add filter to allow modifying response *after* embedded data is added
* #40886 - REST API: PUT requests fail on Nginx servers when fancy permalinks aren't enabled
Taxonomy
* #41010 - wp_get_object_terms() returns duplicate terms if more than one taxonomy is given in args
TinyMCE
* #41408 - TinyMCE: Images with link and caption look "broken" when selected
Widgets
* #40907 - Introduce widget dedicated for HTML code
* #40935 - Facebook Video Works On Preview But Not On Theme
* #40951 - New Text Widget - Switching Between Visual/Text Editor Strips Out Code
* #40960 - Widgets: The Text widget should respect the “Disable the visual editor when writing” setting
* #40972 - TinyMCE editor in Text widget does not have RTL contents
* #40974 - Updated text widget do not save text (when using paste)
* #40977 - Widgets: Query param for `loop` added for non-hosted external videos
* #40986 - Widgets: text widget and media widgets cannot be edited in accessibility mode
* #41021 - Text widget does not show Title field or TinyMCE editor
* #41361 - Text widget can raise JS error if customize-base is enqueued on widgets admin screen
* #41386 - Text Widget - Wording - Legacy Mode 4.8.1 beta
* #41392 - Theme styles for Text widget do not apply to Custom HTML widget
* #41394 - Text widget: Rename legacy mode to visual mode and improve back-compat for widget_text filters
Insufficient redirect validation in the HTTP class. Reported by Ronni
Skansing.
Improper handling of post meta data values in the XML-RPC API. Reported by
Sam Thomas.
Lack of capability checks for post meta data in the XML-RPC API. Reported
by Ben Bidner of the WordPress Security Team.
A Cross Site Request Forgery (CSRF) vulnerability was discovered in the
filesystem credentials dialog. Reported by Yorick Koster.
A cross-site scripting (XSS) vulnerability was discovered when attempting
to upload very large files. Reported by Ronni Skansing.
A cross-site scripting (XSS) vulnerability was discovered related to the
Customizer. Reported by Weston Ruter of the WordPress Security Team.
Fixed security bugs:
* Cross-site scripting (XSS) via media file metadata. Reported by Chris Andrè
Dale, Yorick Koster, and Simon P. Briggs.
* Control characters can trick redirect URL validation. Reported by Daniel
Chatfield.
* Unintended files can be deleted by administrators using the plugin deletion
functionality. Reported by xuliang.
* Cross-site scripting (XSS) via video URL in YouTube embeds. Reported by Marc
Montpas.
* Cross-site scripting (XSS) via taxonomy term names. Reported by Delta.
* Cross-site request forgery (CSRF) in Press This leading to excessive use of
server resources. Reported by Sipke Mellema.
More information here: https://codex.wordpress.org/Version_4.7.3
Changes:
Version 4.7.2
* Remote code execution (RCE) in PHPMailer – No specific issue appears to
affect WordPress or any of the major plugins we investigated but, out of an
abundance of caution, we updated PHPMailer in this release. This issue was
reported to PHPMailer by Dawid Golunski and Paul Buonopane.
* The REST API exposed user data for all users who had authored a post of a
public post type. WordPress 4.7.1 limits this to only post types which have
specified that they should be shown within the REST API. Reported by
Krogsgard and Chris Jean.
* Cross-site scripting (XSS) via the plugin name or version header on
update-core.php. Reported by Dominik Schilling of the WordPress Security
Team.
* Cross-site request forgery (CSRF) bypass via uploading a Flash file. Reported
by Abdullah Hussam.
* Cross-site scripting (XSS) via theme name fallback. Reported by Mehmet Ince.
* Post via email checks mail.example.com if default settings aren’t changed.
Reported by John Blackbourn of the WordPress Security Team.
* A cross-site request forgery (CSRF) was discovered in the accessibility mode
of widget editing. Reported by Ronnie Skansing.
* Weak cryptographic security for multisite activation key. Reported by Jack.
Version 4.7.1
* The user interface for assigning taxonomy terms in Press This is shown to
users who do not have permissions to use it. Reported by David Herrera of
Alley Interactive.
* WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data.
WordPress core is not directly vulnerable to this issue, but we’ve added
hardening to prevent plugins and themes from accidentally causing a
vulnerability. Reported by Mo Jangda (batmoo).
* A cross-site scripting (XSS) vulnerability was discovered in the posts list
table. Reported by Ian Dunn of the WordPress Security Team.
Major changes:
New Default Theme - Twenty Seventeen
- It is an ambitious theme designed for business websites that focuses on a
creative home page and an easy site setup experience for users.
* multiple sections on the front page, selected in the Customizer.
* a striking asymmetrical grid.
* custom color schemes, built on top of a monochromatic foundation, and
adjustable via a hue picker.
* different headline placement for pages, changeable in the Customizer, via
them options.
* a great experience in many languages, thanks to language-specific font stacks.
* SVG icons (a first for a default theme).
* support for custom logo, custom header image and many post formats.
* the use of new functions in Core for making child theming easier.
Note: Twenty Seventeen only works on 4.7 and above. It uses the new
video header and starter content features, each launched in 4.7.
REST API Content Endpoints
* API endpoints for WordPress content. WordPress 4.7 comes with REST API
endpoints for posts, comments, terms, users, meta, and settings. Content
endpoints provide machine-readable external access to your WordPress site
with a clear, standards-driven interface, paving the way for new and
innovative methods of interacting with your site.
WordPress versions 4.6 and earlier are affected by two security issues:
a cross-site scripting vulnerability via image filename, reported by SumOfPwn
researcher Cengiz Han Sahin; and a path traversal vulnerability in the upgrade
package uploader, reported by Dominik Schilling from the WordPress security
team.
WordPress 4.6.1 also fixes 15 bugs from Version 4.6, including:
Bootstrap/Load
#37680 – PHP Warning: ini_get_all() has been disabled for security reasons
- Database
#37683 – $collate and $charset can be undefined in wpdb::init_charset()
#37689 – Issues with utf8mb4 collation and the 4.6 update
- Editor
#37690 – Backspace causes jumping
- Email
#37736 – Emails fail on certain server setups
- External Libraries
#37700 – Warning: curl_exec() has been disabled for security reasons (Requests library)
#37720 – The minified version of the Masonry shim was not updated in #37666 (Masonry library)
- HTTP API
#37733 – cURL error 3: malformed for remote requests
#37768 – HTTP API no longer accepts integer and float values for the cookies argument
- Post Thumbnails
#37697 – Strange behavior with thumbnails on preview in 4.6
- Script Loader
#37800 – Close “link rel” dns-prefetch tag
- Taxonomy
#37721 – Improve error handling of is_object_in_term in taxonomy.php
- Themes
#37755 – Visual Editor: Weird unicode (Vietnamese) characters display on WordPress 4.6
- TinyMCE
#37760 – Problem with RTL
- Upgrade/Install
#37731 – Infinite loop in _wp_json_sanity_check() during plugin install
- Add missing php modules
- Limit work with php-5.6
- Improve the wordpress.conf
- Install wp-config-sample.php to WPHOME but not EGDIR
Patch from wen heping.
For 4.5.1
This maintenance release fixes a total of 12 bugs in Version 4.5 including:
Build/Test Tools
#36498 Shrinkwrap npm dependencies for 4.5
Bundled Theme
#36510 Twenty eleven page templates with widgets incorrectly styled
Customize
#36457 Customizer Device Preview: Use px units for tablet preview size
Database
#36629 Database connect functions can cause un-catchable warnings
Editor
#36458 Fix support for Safari + VoiceOver when editing inline links
Emoji
#36604 Emoji skin tone support test incorrectly passing in Chrome
Feeds
#36620 Feeds using an rss-http content type are now served as application/octet-stream
Media
#36501 Fatal error: Undefined class constant 'ALPHACHANNEL_UNDEFINED'
#36578 wp_ajax_send_attachment_to_editor() bug
#36621 Don’t cache the results of wp_mkdir_p() in a persistent cache
Rewrite Rules
#36506 Duplicate directives in web.config after WordPress 4.5 installation on Windows
TinyMCE
#36545 WordPress TinyMCE toolbar/tabs unresponsive in Chrome Version 50.0.2661.75 beta-m (64-bit)
For 4.5.
What's New
Security
- SSRF Bypass using Octal & Hexedecimal IP addresses, reported by Yu Wang & Tong Shi from BAIDU XTeam
- Reflected XSS on the network settings page, reported by Emanuel Bronshtein (@e3amn2l)
- Script compression option CSRF, reported by Ronni Skansing
Posts
- Inline Link Editing
- Additional Editor Shortcuts
Comments
- Moderate Comment Screen Refresh
- Max Lengths for Comment Form Fields
- Comment Error Page Navigation
Appearance
- Responsive Preview of your site
- Theme Logo Support
- Selective Refresh
- Easy of use
Install Process
Version 4.5 default to generating secret keys and salts locally instead of relying on the WordPress.org API
Detail can be found here:
http://codex.wordpress.org/Version_4.5http://codex.wordpress.org/Version_4.5.1
What's New
General
* Developer reference - Improvements to inline code documentation.
* i18n support - Improvements to translation strings all over the core.
* Admin page headings were adjusted from H3 to H2 tags to reinforce page hierarchy
* Improvements to how list tables are displayed on all size screens
Posts
* The post/page permalink UI was simplified, linking the permalink and removing the "View" button
Comments
* The "View Comment" link was relocated from the Status meta box in the comment-editing screen
* Many comment functions can now accept a full object instead of 'comment_ID' to reduce cache/db lookups
* Orphaned comments now fall back to the 'edit_posts' capability
Appearance
* Site icons will now fall back to the 'full' size URL when the 'thumbnail' size doesn't exist
Multisite
* The language chooser was added to the new site form on wp-signup.php
* Sites may no longer be created with the following reserved slugs: wp-admin, wp-content, wp-includes, or wp-json
Changes:
WordPress 4.2.3 fixes a cross-site scripting vulnerability, which could allow
users with the Contributor or Author role to compromise a site.
The release also fixes an issue where it was possible for a user with
Subscriber permissions to create a draft through Quick Draft.
In addition to the security fixes, WordPress 4.2.3 contains fixes for
21 bugs from 4.2.2, including:
* FIX - Upgrades: If a table has already been converted to utf8mb4,
there's no need to try and convert it again.
* FIX - Remove a redundant index drop.
* FIX - Don't upgrade global tables to utf8mb4 when
DO_NOT_UPGRADE_GLOBAL_TABLES is defined.
* FIX - Enable utf8mb4 for MySQL extension users.
* FIX - Plugin update rely upon wp_update_plugins() to check the
contents of the transient and return early if no request needs to
be made.
* FIX - WPDB: When extracting the table name from a query, there is a
1000 character limit on the SQL string that would be searched.
* FIX - WPDB: When checking that text isn't too long to insert into a
column, LONGTEXT columns could fail, as their length is longer than
PHP_INT_MAX.
* FIX - Plugin update handles the case where the plugin is installed
into a different directory than it previously existed in.
* FIX - Plugin update feature doesn't recognize errors
* FIX - Plugin update error messages lack detail
* FIX - Multiple plugin updates: Even if one of plugins update fails,
allow further updates to continue.
* FIX - In comment_form(), ensure that filtered arguments contain all
required default values.
* FIX - WPDB: Remove some of the complexities in
::strip_invalid_text() associated with switching character sets
between queries.
* FIX - WPDB: ::strip_text_from_query() doesn't pass a length to
::strip_invalid_text(), which was causing queries to fail when they
contained characters that needed to be sanity checked by MySQL.
* FIX - Emoji script is producing errors on pages with SVG content
* FIX - Unable to drag widgets down page past certain length.
* FIX - TinyMCE: wpView: fix typo in createInstance that prevented
instances from being reused.
* FIX - SCRIPT_DEBUG check in print_emoji_detection_script()
generated PHP Notices.
* FIX - If the shortcode content contains HTML code, the TinyMCE View
no longer works.
* FIX - Better handling when the credential form is long (such as
when SSH is active).
* FIX - sanitize_option didn't handle a WP_Error Object.
