WordPress 6.9.4 is now available
WordPress 6.9.2 and WordPress 6.9.3 were released yesterday, addressing 10 security issues and a bug that affected template file loading on a limited number of sites.
The WordPress Security Team has discovered that not all of the security fixes were fully applied, therefore 6.9.4 has been released containing the necessary additional fixes.
Because this is a security release, it is recommended that you update your sites immediately.
You can download WordPress 6.9.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.
For more information on WordPress 6.9.4, please visit the version page on the HelpHub site.
Security updates included in this release
The security team would like to thank the contributors who reported and investigated this issue, in particular Thomas Kräftner for his responsible disclosure. The security issues that are resolved in 6.9.4 are:
- A PclZip path traversal issue reported independently by Francesco Carlucci and kaminuma
- An authorization bypass on the Notes feature reported by kaminuma
- An XXE in the external getID3 library reported by Youssef Achtatal
Tags
Related Posts
WordPress 7.1 “Mary Lou”
WordPress 7.1, “Mary Lou,” is here—celebrating the pioneering jazz pianist, composer, and arranger Mary Lou Williams and her spirit of reinvention and collaboration. This release brings a more flexible, responsive, and collaborative WordPress experience, with new responsive styling controls, a redesigned media editor, richer Notes with mentions and inline feedback, improved image processing, and new Playlist and Tabs blocks.
WordPress 7.0.4 Release
WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately.
WordPress 7.0.3 release
WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.