WordPress 5.2.4 is now available! This security release fixes 6 security issues.
WordPress versions 5.2.3 and earlier are affected by these bugs, which are fixed in version 5.2.4. Updated versions of WordPress 5.1 and earlier are also available for any users who have not yet updated to 5.2.
Security Updates
Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer.Props to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript into style tags.Props to David Newman for highlighting a method to poison the cache of JSON GET requests via the Vary: Origin header.Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs are validated.Props to Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin.
Thank you to all of the reporters for privately disclosing the vulnerabilities, which gave us time to fix them before WordPress sites could be attacked.
For more info, browse the full list of changes on Trac or check out the Version 5.2.4 documentation page.
WordPress 5.2.4 is a short-cycle security release. The next major release will be version 5.3.
You can download WordPress 5.2.4 or visit Dashboard → Updates and click Update Now. Sites that support automatic background updates have already started to update automatically.
In addition to the security researchers mentioned above, thank you to everyone who contributed to WordPress 5.2.4:
Aaron D. Campbell, darthhexx, David Binovec, Jonathan Desrosiers, Ian Dunn, Jeff Paul, Nick Daugherty, Konstantin Obenland, Peter Wilson, Sergey Biryukov, Stanimir Stoyanov, Garth Mortensen, vortfu, Weston Ruter, Jake Spurlock, and Alex Concha.
More Stories
golang-github-cncf-xds-0-0.10.20230912gite9ce688.fc39 golang-github-envoyproxy-control-plane-0.11.1-1.fc39 golang-github-nats-io-1.30.1-1.fc39 golang-github-nats-io-jwt-2-2.5.2-1.fc39 golang-github-nats-io-nkeys-0.4.5-2.fc39 golang-github-protobuf-1.5.3-3.fc39 golang-google-protobuf-1.31.0-4.fc39 nats-server-2.10.1-3.fc39
FEDORA-2023-6b89bc0305 Packages in this update: golang-github-cncf-xds-0-0.10.20230912gite9ce688.fc39 golang-github-envoyproxy-control-plane-0.11.1-1.fc39 golang-github-nats-io-1.30.1-1.fc39 golang-github-nats-io-jwt-2-2.5.2-1.fc39 golang-github-nats-io-nkeys-0.4.5-2.fc39 golang-github-protobuf-1.5.3-3.fc39 golang-google-protobuf-1.31.0-4.fc39 nats-server-2.10.1-3.fc39 Update description: Contains updates to address CVE-2022-{28357,41717}...
bind-9.18.19-1.fc39 bind-dyndb-ldap-11.10-21.fc39
FEDORA-2023-b4acb0f7c6 Packages in this update: bind-9.18.19-1.fc39 bind-dyndb-ldap-11.10-21.fc39 Update description: BIND 9.18.19 Security Fixes Previously, sending a specially crafted message over...
golang-github-nats-io-1.30.1-1.fc40 golang-github-protobuf-1.5.3-3.fc40 nats-server-2.10.1-3.fc40
FEDORA-2023-5f904f4dd4 Packages in this update: golang-github-nats-io-1.30.1-1.fc40 golang-github-protobuf-1.5.3-3.fc40 nats-server-2.10.1-3.fc40 Update description: Contains updates to address CVE-2022-{28357,41717} Read More
[tool] WatchGuard Firebox Web Update Unpacker
Posted by retset on Sep 25 A small utility for extracting file system images from "sysa-dl" update files. https://github.com/ret5et/Watchguard_WebUI_Unpacker Read...
CVE-2022-4244
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and...
CVE-2022-4245
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that...