WordPress 5.4.1 is now available!
This security and maintenance release features 17 bug fixes in addition to 7 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.
WordPress 5.4.1 is a short-cycle security and maintenance release. The next major release will be version 5.5.
You can download WordPress 5.4.1 by downloading from WordPress.org, or visit your Dashboard → Updates and click Update Now.
If you have sites that support automatic background updates, they’ve already started the update process.
Security Updates
Seven security issues affect WordPress versions 5.4 and earlier. If you haven’t yet updated to 5.4, all WordPress versions since 3.7 have also been updated to fix the following security issues:
Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated.Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated.Props to Evan Ricafort for discovering an XSS issue in the CustomizerProps to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block.Props to Nick Daugherty from WordPress VIP / WordPress Security Team who discovered an XSS issue in wp-object-cache.Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.Props to Weston Ruter for fixing a stored XSS vulnerability in the WordPress customizer.Additionally, an authenticated XSS issue in the block editor was discovered by Nguyen The Duc (ducnt) in WordPress 5.4 RC1 and RC2. It was fixed in 5.4 RC5. We wanted to be sure to give credit and thank them for all of their work in making WordPress more secure.
Thank you to all of the reporters for privately disclosing the vulnerabilities. This gave the security team time to fix the vulnerabilities before WordPress sites could be attacked.
For more information, browse the full list of changes on Trac, or check out the version 5.4.1 HelpHub documentation page.
In addition to the security researchers mentioned above, thank you to everyone who helped make WordPress 5.4.1 happen:
Alex Concha, Andrea Fercia, Andrew Duthie, Andrew Ozz, Andy Fragen, Andy Peatling, arnaudbroes, Chris Van Patten, Daniel Richards, DhrRob, Dono12, dudo, Ehtisham Siddiqui, Ella van Durpe, Garrett Hyder, Ian Belanger, Ipstenu (Mika Epstein), Jake Spurlock, Jb Audras, John Blackbourn, John James Jacoby, Jonathan Desrosiers, Jorge Costa, K. Adam White, Kelly Choyce-Dwan, MarkRH, mattyrob, Miguel Fonseca, Mohammad Jangda, Mukesh Panchal, Nick Daugherty, noahtallen, Paul Biron, Peter Westwood, Peter Wilson, pikamander2, r-a-y, Riad Benguella, Robert Anderson, Samuel Wood (Otto), Sergey Biryukov, Søren Brønsted, Stanimir Stoyanov, tellthemachines, Timothy Jacobs, Toro_Unit (Hiroshi Urabe), treecutter, and yohannp.
More Stories
CVE-2022-35908
Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent. Read More
thunderbird-115.3.1-1.fc39
FEDORA-2023-1afa208698 Packages in this update: thunderbird-115.3.1-1.fc39 Update description: Update to 115.3.1 ; https://www.thunderbird.net/en-US/thunderbird/115.3.1/releasenotes/ ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ Update to 115.3.0 ; https://www.thunderbird.net/en-US/thunderbird/115.3.0/releasenotes/...
libptytty-2.0-4.el7 rxvt-unicode-9.31-1.el7
FEDORA-EPEL-2023-a99c56df6a Packages in this update: libptytty-2.0-4.el7 rxvt-unicode-9.31-1.el7 Update description: The last update for rxvt-unicode stripped it down to just the...
libvpx-1.13.0-5.fc39
FEDORA-2023-10ff82e497 Packages in this update: libvpx-1.13.0-5.fc39 Update description: Security fix for CVE-2023-5217 Read More
libvpx-1.12.0-3.fc37
FEDORA-2023-f696934fbf Packages in this update: libvpx-1.12.0-3.fc37 Update description: Security fix for CVE-2023-5217 Read More
libvpx-1.13.0-5.fc38
FEDORA-2023-c896cf87db Packages in this update: libvpx-1.13.0-5.fc38 Update description: Security fix for CVE-2023-5217 Read More